The Personal Data Protection Law: what a company must do

Who it applies to

The Personal Data Protection Law applies to any organisation that processes personal data of people in the Kingdom, including companies outside it. Every company holds personal data: employee files, customer contacts, supplier records, CCTV. The Law is overseen by SDAIA, the national data regulator, and companies have been expected to comply since September 2024.

The core obligations

• Have a lawful basis for each use of personal data, such as consent, a contract or a legal obligation.
• Tell people what you collect and why, in a clear privacy notice.
• Collect only what you need and keep it only as long as you need it.
• Keep a record of your processing activities, and appoint a data protection officer where the regulations require one, for example where sensitive data is processed as a core activity.
• Protect the data with suitable security, and limit access to those who need it.

People’s rights

• To know how their data is used.
• To access a copy of their data.
• To have incorrect data corrected.
• To have data destroyed when it is no longer needed.
• Requests must be answered within the period the regulations set.

When things go wrong

• A data breach must be reported to SDAIA within 72 hours of becoming aware of it, where it may harm people.
• Affected people must be told where the breach may harm them.
• Breaches of the Law can lead to a warning or a fine of up to SAR 5 million, doubled for repeat offences.
• Disclosing sensitive data unlawfully to cause harm or for personal gain can lead to up to two years in prison and a fine of up to SAR 3 million.

Sending data abroad

• Transfers outside the Kingdom are allowed to countries with adequate protection, or with safeguards such as SDAIA’s standard contractual clauses, under the transfer regulations.
• Check where your systems store data, including cloud email, payroll and HR software.

How we run it

Our own work runs under the Law, and for clients we review how HR and finance data is held, write the notices and records the Law asks for, and keep access limited to the people who need it.