Saudi Arabia’s New Personal Data Protection Law – Key Action Points

The Kingdom of Saudi Arabia (KSA) has enacted a new comprehensive data protection law (the PDPL), which comes into force on 23 March 2022. The first standalone data protection law of its kind in KSA, the PDPL is a significant development and seeks to further develop the Kingdom’s legislative landscape in a way that is consistent with the goals of its’ 2030 Vision to develop a digital infrastructure and support innovation to grow a digital economy.

Further executive regulations (the Regulations) are expected to be published to supplement the new law ahead of the PDPL’s enforcement date. The Regulations will provide additional guidance in respect of the practical application of the PDPL, including specific rules relating to the lawful transfer of data outside of KSA and the processing of credit data. In the following insight, we have set out an overview of the key practical takeaways from the new law.