Article 15 of the Saudi Protection of Whistleblowers, Witnesses, Experts and Victims Law

This article sets a short but essential general rule: the data of protected persons is confidential, and it may not be disclosed except in the cases set out in the Law.

This means that secrecy is the default and disclosure is an exception, permitted only in a case that the Law itself provides for.

This rule is linked to the articles before and after it:

• Article 14 makes concealing the protected person's personal data and everything that indicates their identity throughout the protection period one of the types of protection.
• Article 16 elaborates on this confidentiality. It bars anyone from disclosing, directly or indirectly, anything likely to harm the protected person, such as information that indicates their identity or whereabouts, the types of protection provided to them or its procedures, or the identity or role of those providing it. It then sets out the exceptions: the protected person's consent, a request from a competent judicial body based on a court order or from a security body in the cases it specifies, and a request from the security bodies for purposes related to national security, with disclosure only to the requesting body and within the narrowest scope.

A protected person, as defined in Article 1, is someone for whom the program administration decides to provide any type of protection.