Article 16 of the Saudi Protection of Whistleblowers, Witnesses, Experts and Victims Law

This article elaborates on the general rule in Article 15 that the data of protected persons is confidential. It has three paragraphs:

First: what is prohibited. No person may disclose, directly or indirectly, anything likely to harm the protected person, including:

• any information that reveals, or from which one can infer, the protected person's identity, personality or whereabouts;
• any information about the types of protection provided to them or its procedures;
• the identity or role of anyone who provides them with protection or helps provide it.

Second: the exceptions. The following are excepted from this prohibition:

• the protected person's consent to disclosing their identity or any information that may indicate their personality;
• a request for information about their identity from a competent judicial body based on a court order, or from a security body, where there are reasons to believe that the protected person can provide information or evidence about a crime that has been committed, or to prevent such a crime;
• a request from the security bodies for information about their identity for purposes related to national security.

In the last two exceptions, the information may be disclosed only to the requesting body and within the narrowest scope.

Third: notification. If disclosure is decided under the last two exceptions, the program administration must notify the protected person.

Note that the prohibition is addressed to "any person" and covers both direct and indirect disclosure, so it is not limited to those working in the program. Article 17 complements this protection by prohibiting employment measures that harm the protected person if they relate to the reasons for which protection was decided.