Most global businesses today are well acquainted with the challenges of transferring personal data across borders, primarily relying on adequacy decisions (where they apply) and various transfer solutions to ensure compliance with transfer requirements. These mechanisms have become the bedrock of global data transfer strategies, providing a structured framework that balances the free flow of information with the safeguarding of individual privacy rights. In this context, the Kingdom of Saudi Arabia's transfer regime offers a similar structure that aligns with global practices while addressing the unique regulatory landscape of the Kingdom of Saudi Arabia (the Kingdom). This alignment not only facilitates smoother international collaborations but also underscores the Kingdom's commitment to maintaining robust data protection standards.

Under the Regulation on Personal Data Transfer Outside of the Kingdom, as amended (the Transfer Regulations) and enacted by the Saudi Data and AI Authority (SDAIA), personal data can be freely transferred to countries that SDAIA considers offer a level of data protection that is comparable to that of the Kingdom, provided that any transfers made are limited to the minimum personal data necessary in all circumstances. SDAIA's assessment to determine a jurisdiction's adequacy involves evaluating several factors including, amongst others, the existence of regulations governing personal data in that jurisdiction (including whether individuals have the right to seek compensation for damages relating to violations of the regulations), the presence of a regulatory body overseeing compliance with such regulations and the willingness of that supervisory authority to co-operate with SDAIA. As of the date of this article, SDAIA has not yet released the list of jurisdictions deemed to offer an adequate level of data protection.

Where an organisation cannot rely on adequacy, transfers can only be made outside the Kingdom, where the parties adopt any of the three adequate safeguards set out below. These safeguards are particularly relevant at present given that the list of adequate jurisdictions has not yet been published by SDAIA.

Appropriate safeguards for data transfers where adequacy is not achieved

Standard Contractual Clauses (SCCs)

The SCCs are a set of pre-approved legal terms that the sender and the recipient of the personal data both agree to follow. These terms are designed to ensure that any personal data continues to be protected, even when it is transferred to a country that might not afford the same level of protection to the personal data as is expected in the Kingdom.

SDAIA published the SCCs in September 2024 and they can be found here. They are available in four different forms to accommodate various types of transfer arrangements (i.e. Controller to Controller, Controller to Processor, Processor to Processor and Processor to Controller). These SCCs cannot be modified but may be incorporated into other agreements or supplemented by other terms, provided the additional terms do not contradict the SCCs or water down the rights of individuals.

Binding Common Rules (BCRs)

These are internal rules, similar to a code of conduct, that govern data transfers within a corporate group. Where adopted, these BCRs allow entities in a group to transfer personal data from the Kingdom to their affiliates located outside the Kingdom.

SDAIA has issued new guidelines on BCRs which can be found here. These guidelines set out the requirements for the BCRs, including ensuring they contain obligations to comply with the Personal Data Protection Law (PDPL) of the Kingdom and its Implementing Regulations, uphold data subject rights, co-operate with SDAIA, enforce the BCRs on all group entities and adopt appropriate data protection policies and procedures.

Certifications of accreditation

Where an entity has received a certification of accreditation from SDAIA or entities authorised by SDAIA to issue such certificates, they can transfer personal data outside the Kingdom. These are certifications that confirm that the entity complies with the PDPL and its Implementing Regulations.

Risk assessments

Risk assessments will be required under the Transfer Regulations where the parties are relying on any of the three appropriate safeguards set out above or where they are transferring large amounts of sensitive personal data (such as information relating to an individual's health, racial or ethnic origin, intellectual or political beliefs, genetic data or biometric data etc.) or transferring sensitive personal data on a continuous basis.

Prejudice the national security or vital interests of the Kingdom

It is noted though that, in all cases, transfers outside the Kingdom must not prejudice the national security or vital interests of the Kingdom. It remains to be seen how and when the SDAIA will rely on this criterion to block transfers, but it does grant the SDAIA broad authority to restrict transfers on the basis that they violate this requirement.

Conclusion

As confirmed above, whilst SDAIA has not at the date of writing released the list of adequate jurisdictions to which data can be transferred freely, given the PDPL came into force on 14 September 2024, companies may be expected to put temporary measures in place (such as the SCCs) until the list of adequate jurisdictions is published.

For further assistance and detailed guidance on becoming compliant with the Transfer Regulations, please do not hesitate to contact Henrietta Baker or Kahroba Kojouri.