Article 7 of the Saudi Personal Data Protection Law
المادة 7 من نظام حماية البيانات الشخصية
Consent to processing personal data may not be made a condition for providing a service or benefit, unless the service or benefit is related to the processing that was consented to.
Official text (Arabic)
This article has not been amended since the law was issued.
لا يجوز أن تكون الموافقة المشار إليها في الفقرة (1) من المادة (الخامسة) من النظام شرطاً لإسداء خدمة أو تقديم منفعة، ما لم تكن الخدمة أو المنفعة ذات علاقة بمعالجة البيانات الشخصية التي صدرت الموافقة عليها.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 7 explained in plain English
This article protects the data subject from "imposed consent", that is, an entity saying to them: we will not provide you the service unless you consent to processing your data for a purpose unrelated to it.
The rule: The consent referred to in paragraph 1 of Article 5 may not be a condition:
- for rendering a service; or
- for providing a benefit.
The exception: The service or benefit may be tied to consent if it is related to the processing of personal data that was consented to. If the service can itself only be performed by processing particular data, then asking for consent to that processing does not fall within the prohibition.
The test for telling them apart is therefore whether there is a relationship between the service or benefit and the processing for which consent is requested. The article does not lay down a detailed standard for this relationship, so assessing it depends on the circumstances of each case.
This article comes after Article 6, which sets out the cases in which processing is not subject to consent at all, completing the framework of consent: consent as the rule, specific exceptions, and a ban on using a service as a means of pressuring the data subject. Article 8 then moves on to the controller's obligations when choosing a processor.
Practical example
A clinic appointment booking app in Jeddah asks the user to consent to sharing their browsing history with advertisers as a condition of booking an appointment. This tying is not permitted because booking an appointment has no relation to that processing. Asking for a name and mobile number to confirm the appointment, however, is related to the service itself.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 7 of Personal Data Protection Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Commercial & Corporate Law lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Commercial & Corporate Law lawyers
Lawyers who handle this kind of case
شركة امتداد النظام للمحاماة والاستشارات المهنية
- Labour & Employment Law
- Criminal Law
- Criminal Law
- Commercial & Corporate Law
Frequently asked questions about Article 7 of the Saudi Personal Data Protection Law
Can a company refuse me service if I don't consent to the use of my data?
Consent may not be made a condition for providing a service or benefit, unless the service or benefit is related to the processing that was consented to.
When can a service be tied to consent over data?
When the service or benefit is related to the processing of personal data that was consented to.
Articles this article refers to
More articles on Consent to Processing Data
- Article 5Amended by M/148
Personal data may not be processed, nor the purpose of processing changed, except with the data subject's consent, apart from cases the law provides, and the data subject may withdraw consent at any time.
1- فيما عدا الأحوال المنصوص عليها في النظام، لا تجوز معالجة البيانات الشخصية أو تغيير الغرض من معالجتها إلاَّ بعد موافقة صاحبها. وتُبين اللوائح شروط الموافقة، و
- Article 6Amended by M/148
The article sets out four cases in which personal data may be processed without the consent of its owner referred to in paragraph 1 of Article 5.
لا تخضع معالجة البيانات الشخصية للموافقة المشار إليها في الفقرة (1) من المادة (الخامسة) من النظام، في الأحوال الآتية: 1- عندما تُحقق المعالجة مصلحة متحققة لصاحب
- Article 10Amended by M/148
The rule is that personal data is collected from its owner directly and processed for the purpose it was collected for, with seven cases in which it may be collected from others or processed for another purpose.
لا يجوز لجهة التحكم جمع البيانات الشخصية إلا من صاحبها مباشرةً، ولا تجوز مُعالجة تلك البيانات إلا لتحقيق الغرض الذي جُمعت من أجله. ومع ذلك، يجوز لجهة التحكم جمع
- Article 11Amended by M/148
The article requires that the purpose of collecting data be linked to the controller's purposes, that the means be lawful, clear and secure, and that the content be limited to the minimum necessary.
1- يجب أن يكون الغرض من جمع البيانات الشخصية ذا علاقة مُباشرة بأغراض جهة التحكم، وألاَّ يتعارض مع أي حكم مقرر نظاماً. 2- يجب ألاَّ تتعارض طُرق جمع البيانات الشخ
- Article 24Amended by M/148
The article refers to the regulations the setting of additional controls for processing credit data, including verifying explicit consent and notifying the data subject when disclosure of it is requested.
تُحدد اللوائح الضوابط والإجراءات الإضافية -بما لا يتعارض مع أحكام النظام- في شأن معالجة البيانات الائتمانية بما يكفل المحافظة على خصوصية أصحابها ويحمي حقوقهم ال
- Article 26
Non-sensitive personal data may be processed for marketing purposes if it was collected directly from the data subject and they consented under the Law; the regulations set the controls.
فيما عدا البيانات الحساسة، تجوز معالجة البيانات الشخصية لأغراض تسويقية، إذا جرى جمعها من صاحبها مباشرةً ووافق على ذلك وفق أحكام النظام. وتحدد اللوائح الضوابط ال
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.