Article 41 of the Saudi Personal Data Protection Law
المادة 41 من نظام حماية البيانات الشخصية
The article requires everyone who has performed any personal data processing work to keep its secrets, and the obligation continues even after their employment or contractual relationship ends.
Official text (Arabic)
This article has not been amended since the law was issued.
يلتزم كل من باشر عملاً من أعمال معالجة البيانات الشخصية بالمحافظة على الأسرار المتعلقة بالبيانات حتى بعد انتهاء علاقته الوظيفية أو التعاقدية.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 41 explained in plain English
This article imposes a general duty of confidentiality on everyone who has dealt with personal data in the course of their work.
Who is bound? "Anyone who has performed any personal data processing work." The wording is broad: it is not limited to the controller or the processor, but includes the individuals who actually carried out any processing work, such as employees and contractors.
Subject of the obligation: keeping the secrets relating to the data, that is, not disclosing the data that the person saw because of their work in processing it.
Duration of the obligation: it does not end when the work ends; the text is explicit that it continues even after the employment or contractual relationship ends. An employee who resigned or whose contract ended, and a contractor whose project ended, remain bound to keep those secrets.
Relationship to Article 40: if a person violates this obligation and the violation causes harm to others, Article 40 gives anyone who suffers harm from any violation of the Law the right to claim before the competent court compensation for material or moral damage, without prejudice to imposing the penalties stipulated in the Law.
The article does not set a time period after which the obligation ends, and does not mention exceptions. To learn the consequences in a particular case, it is advisable to consult a lawyer specialized in personal data protection and technology law.
Practical example
Sarah worked in the customer service department of a telecom company in Jeddah and, because of her work, saw subscribers' data. After she resigned and moved to another company, she remains bound to keep the secrets of that data, and she may not disclose it even though her employment relationship has ended.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 41 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Commercial & Corporate Law lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Commercial & Corporate Law lawyers
Lawyers who handle this kind of case
شركة امتداد النظام للمحاماة والاستشارات المهنية
- Labour & Employment Law
- Criminal Law
- Criminal Law
- Commercial & Corporate Law
Frequently asked questions about Article 41 of the Saudi Personal Data Protection Law
Is an employee still bound to keep data confidential after resigning?
Yes. The article provides that the obligation to keep the secrets relating to the data continues even after the employment or contractual relationship ends.
Who is bound by the duty of confidentiality for personal data?
Anyone who has performed any personal data processing work, whether their relationship is employment or contractual.
Can I claim compensation if a former employee disclosed my data?
Article 40 gives anyone who suffers harm from a violation of the provisions of the Law the right to claim before the competent court compensation for material or moral damage.
More articles on Controller's Obligations
- Article 8Amended by M/148
The article requires the controller to choose a processor that provides the guarantees needed to implement the law and regulations and to verify its compliance, without prejudice to the controller's responsibilities.
مع مراعاة ما ينص عليه النظام واللوائح في شأن الإفصاح عن البيانات الشخصية، على جهة التحكم عند اختيارها جهة المعالجة أن تلتزم باختيار الجهة التي توفر الضمانات الل
- Article 10Amended by M/148
The rule is that personal data is collected from its owner directly and processed for the purpose it was collected for, with seven cases in which it may be collected from others or processed for another purpose.
لا يجوز لجهة التحكم جمع البيانات الشخصية إلا من صاحبها مباشرةً، ولا تجوز مُعالجة تلك البيانات إلا لتحقيق الغرض الذي جُمعت من أجله. ومع ذلك، يجوز لجهة التحكم جمع
- Article 11Amended by M/148
The article requires that the purpose of collecting data be linked to the controller's purposes, that the means be lawful, clear and secure, and that the content be limited to the minimum necessary.
1- يجب أن يكون الغرض من جمع البيانات الشخصية ذا علاقة مُباشرة بأغراض جهة التحكم، وألاَّ يتعارض مع أي حكم مقرر نظاماً. 2- يجب ألاَّ تتعارض طُرق جمع البيانات الشخ
- Article 12Amended by M/148
The article requires the controller to adopt a privacy policy made available to data subjects when their data is collected, and sets the elements it must include.
على جهة التحكم أن تعتمد سياسة للخصوصية، وأن تجعلها متاحة لأصحاب البيانات الشخصية ليطلعوا عليها عند جمع بياناتهم. على أن تشتمل تلك السياسة على تحديد الغرض من جمع
- Article 13Amended by M/148
When collecting data directly from its owner, the controller must inform them of seven elements, including the legal basis, the purpose, the identity of the collector and the entities to which the data will be disclosed.
على جهة التحكم، في حالة جمع البيانات الشخصية من صاحبها مباشرةً، اتخاذ الوسائل الكافية لإحاطته علماً بالعناصر الآتية عند جمع بياناته: 1- المسوغ النظامي لجمع بيان
- Article 14
The controller may not process personal data without adequate steps to verify its accuracy, completeness, currency and relation to the purpose for which it was collected.
لا يجوز لجهة التحكم أن تعالج البيانات الشخصية دون اتخاذ خطوات كافية للتحقق من دقتها واكتمالها وحداثتها وارتباطها بالغرض الذي جُمعت من أجله وفقاً لأحكام النظام.
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.