In brief
On 11 July 2023, the Saudi Authority for Data and Artificial Intelligence (SDAIA) published two drafts of regulations to the Personal Data Protection Law promulgated by Royal Decree No. M/19, dated 09/02/1443H, amended pursuant to Royal Decree No. M/148, dated 05/09/1444H (PDPL). The drafts were published for public consultation and will be open to public commentary until 31 July 2023. While the drafts are not binding, they do provide helpful insights with regards to the potential direction the SDAIA could take once it issues the final implementing regulations.
The draft regulations include general Implementing Regulations (“Implementing Regulations“) and Data Transfer Regulations (“Data Transfer Regulations”). The latter applies to cross-border data transfers outside the geographical boundaries of the Kingdom of Saudi Arabia (KSA).
Based on the timing provided in the draft Implementing Regulations, it is anticipated that the final version will be published before the expected date of entry into force of the PDPL, i.e. 14 September 2023.
The draft Implementing Regulations and Data Transfer Regulations address a number of critical matters that were not detailed in the PDPL, and further clarify the provisions and procedures applicable to controllers.
Please click on the “Download Alert” button below to view our high level summary of the most notable features of the Implementing Regulations and Data Transfer Regulations as well as our initial key takeaways. You can also access our previous alert on the publication of the amended PDPL here.
We are continuing to closely monitor developments related to the data privacy framework in the KSA. Should you have any inquiries regarding the draft Implementing Regulations, Data Transfer Regulations or any data and technology-related matters, feel free to contact us.
