The Kingdom of Saudi Arabia (KSA) is currently considering revisions to the Implementing Regulations of the Personal Data Protection Law (Implementing Regulations) and has opened the proposed amendments for public consultation. While most of the proposed changes are not material and are primarily aimed at providing further clarity, there are some proposed amendments that are expected to have a practical impact on organisations. Below, we have set out the amendments that are particularly relevant and noteworthy.

Key proposed revisions

• Privacy policy requirements

The proposed amendments stress the importance of drafting privacy policies so that they are easy to understand and using straightforward language that caters to varying levels of understanding among individuals. Moreover, the language of the privacy policy should match the language typically used in the provision of the services or products to individuals. This proposed amendment is particularly useful as it addresses the ambiguity around whether privacy policies have to be translated to different languages in the KSA.

• Consent for advertising

The proposed amendment maintains the requirement for obtaining consent before sending advertising or awareness materials. However, it suggests removing the provision that previously allowed controllers to forego obtaining consent if there had been prior interaction with the targeted recipient. As a result, under this proposal, consent would be required for the sending of all advertising and awareness materials, irrespective of whether there was any prior interaction between the controller and the targeted recipient.

• Marketing consent

Under the current Implementing Regulations, organisations are required to obtain consent for processing personal data for Direct Marketing purposes. "Direct Marketing" was broadly defined to include any direct physical or electronic communication aimed at marketing, including advertisements or promotions. The proposed amendments suggest the removal of the definition of "Direct Marketing" and instead require consent for use of personal data for "Marketing" purposes. The impact of this proposed change remains to be seen since "Marketing" has not been defined in the proposed amendments.

• Role of the Data Protection Officer (DPO)

The amendments offer more clarity on the responsibilities of the DPO, ensuring that organisations understand the scope of a DPO's duties in monitoring compliance. In addition, organisations are now required to input the contact details of their DPO into the National Data Governance Platform, which is an electronic platform under the purview of SDAIA which aims to provide support services and tools for the enforcement of the Personal Data Protection Law (PDPL) and its Implementing Regulations.

• Registration with SDAIA

The proposed changes will mean that registration requirements previously outlined in the "Rules Governing the National Register of Controllers Within the Kingdom" will be incorporated into the Implementing Regulations. The circumstances that necessitate registration include all existing scenarios set out in the rules, with the addition of the requirement to register with SDAIA where the organisation is transferring personal data outside the KSA. Given the broad criteria for registration (with the addition of the new proposed criteria relating to transfers), it is likely that data controllers will be required to register with SDAIA in most circumstances.

• Records of Processing Activities (ROPA)

A new proposed requirement provides that the National Data Governance Platform must contain a separate register for each controller where the controller's records of processing activities must be recorded. Currently, organisations only need to provide their ROPA to SDAIA upon request.

• Response to requests

A new proposed provision requires controllers to respond to requests from SDAIA regarding their compliance with the PDPL and its Implementing Regulations within 10 business days. This is a short turnaround time, emphasising the need for organisations to maintain efficient processes and readiness to ensure timely responsiveness.

• Complaint submission

The proposed amendments suggest removing the previous 90-day limit for submitting complaints, allowing data subjects to file complaints at any time. This change provides greater flexibility for data subjects to seek redress without being constrained by a strict timeframe.

While many of the proposed amendments to the Implementing Regulations are intended to clarify existing provisions, the proposed changes highlighted above introduce important considerations for organisations. As the public consultation progresses, organisations should prepare to adjust their practices to align with any updates to the Implementing Regulations. The end date for the consultation is 27 May 2025.