With the 14 September 2024 deadline on the horizon for compliance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia (KSA), it is imperative for businesses to prepare for enforcement.

Understanding the PDPL

The PDPL serves as the cornerstone of data protection in the KSA. The PDPL, alongside its Implementing Regulations, aims to regulate the processing of personal data, ensuring the privacy and protection of individuals' rights.

While the PDPL takes inspiration from the General Data Protection Regulation (GDPR), a benchmark for data protection laws globally, it is important for businesses to recognise that there are also distinct and notable differences between the GDPR and the PDPL. This necessitates a careful examination of the PDPL's unique provisions. Businesses must be aware that simply transplanting GDPR-compliant policies may not be sufficient for PDPL compliance. Understanding the nuances will be critical for businesses to ensure they comply with all requirements of the PDPL.

Scope of the PDPL

The PDPL casts a wide net and applies to any businesses located in the KSA that process personal data, as well as to entities located outside the KSA that process the personal data of individuals in the KSA. The processing of personal data of deceased individuals also appears to fall within the scope of the PDPL, if the processing could lead to the identification of the deceased or that of a family member.

Implications for organisations

• Increased accountability: Organisations are expected to adopt comprehensive data protection policies and procedures and embed data protection into all business operations.
• Data Protection Officers (DPOs): For larger organisations that may engage in high-risk data processing activities, appointing a DPO to oversee compliance efforts is crucial.
• Data breach notifications: In the event of a personal data breach, timely notification to the Saudi Data & AI Authority and affected individuals is mandatory in certain circumstances.
• Cross-border data transfers: The PDPL completely prohibits transfers of personal data outside the KSA if they could impact the nation's security or vital interests, or if they contravene any other KSA laws. Where these prohibitions do not apply, transfers of personal data outside the KSA are restricted unless the recipient country is deemed to provide an adequate level of protection for personal data or the parties put adequate safeguards in place (including by entering into standard contractual clauses). It is noted that the list of countries that will benefit from adequacy has not yet been published, neither have the standard contractual clauses that businesses can rely on to transfer personal data lawfully outside the KSA.
• Training and awareness: Investing in staff training is vital to ensure everyone within an organisation understands their role in maintaining PDPL compliance.
• Vendor management: Organisations must ensure that (i) any service providers they engage to process personal data on their behalf are compliant with the PDPL; and (ii) the contracts they enter into with their service providers contain PDPL mandated provisions.
• Enhanced individual rights: Individuals are afforded certain rights in respect of their personal data under the PDPL. Organisations must ensure that mechanisms are in place to address these rights promptly and effectively.
• Financial implications: Non-compliance could result in significant penalties. For instance, individuals and/or legal entities in breach of the PDPL can be fined up to SAR5 million (approximately US$1.3 million), which may be doubled for repeat violations, and individuals found guilty of intentionally disclosing sensitive personal data unlawfully could face up to two years' imprisonment and/or incur fines of up to SAR3 million (approximately US$800,000). Possible imprisonment represents a serious risk in non-compliance with the PDPL.

Action steps

With enforcement in sight, it is imperative for organisations to:

1. Conduct a thorough PDPL compliance audit of their operations.
2. Review or establish data protection policies, procedures and processes.
3. Appoint or designate a DPO, where necessary.
4. Train staff on PDPL requirements.
5. Prepare for potential financial implications due to non-compliance.

Conclusion

The PDPL represents a significant shift in the data protection landscape of the KSA. As the deadline for compliance draws closer, businesses must act swiftly to review and revise their data handling processes and practices as the cost of inaction could be substantial.

For further assistance and detailed guidance on becoming PDPL compliant, please do not hesitate to contact henrietta.baker@dentons.com or kahroba.kojouri@dentons.com.

This article is also available in Arabic, click here to download.