Lakhasly

How does the law compare with international standards?The PDPL includes most of the essential international standards in data protection such as: data subject rights, legal basis for data processing (non consent based and consent based), privacy policies requirements, obligations of notification in case of data breaches, necessity of impact assessments before processing personal data, specific provisions on health data, credit data, controllers' obligations and due diligence, the establishment of a supervising authority and sanctions in cases of violations.The list goes on.

Many features of the Saudi Personal Data Protection Law (PDPL) are aligned with the standards and principles contained in other international data protection laws such as the General Data Protection Regulation (GDPR) 2016/679, the regulation in EU law on data protection and privacy in the European Union and the European Economic Area.We believe that this law was passed in order to attract international businesses, especially in the new technologies field and to keep up with other Gulf countries, just like the UAE.

How does the law compare with international standards?

The PDPL includes most of the essential international standards in data protection such as: data subject rights, legal basis for data processing (non consent based and consent based), privacy policies requirements, obligations of notification in case of data breaches, necessity of impact assessments before processing personal data, specific provisions on health data, credit data, controllers’ obligations and due diligence, the establishment of a supervising authority and sanctions in cases of violations. The list goes on.

Many features of the Saudi Personal Data Protection Law (PDPL) are aligned with the standards and principles contained in other international data protection laws such as the General Data Protection Regulation (GDPR) 2016/679, the regulation in EU law on data protection and privacy in the European Union and the European Economic Area. We will point out in the table below the differences between the Saudi PDPL and the European GDPR, taken as an international standard.The GDPR currently provides the most comprehensive protection for personal data and has an important influence on laws and regulations outside of the EU as upcoming legislations are using the GDPR as a “starting point” for their laws.

It appears that a transition period of 18 month will be set before the PDPL if fully applicable to local entities and an even longer period for organizations based outside the Kingdom. Additional details and guidance should be issued in the period leading up to the PDPL going into effect.

This law is an important step forward in data protection and a start for KSA.

Some of the articles and the exceptions related to security, the Kingdom’s reputation, the Kingdom’s diplomatic relations, confidential sources of information, exceptions related to the public authorities, etc. are concerning as they are vague and non-defined. These exceptions and loopholes, coupled with Saudi Arabia’s poor human rights record and surveillance practices testify of yet another attempt at controlling the digital space.

Even if the law appears“good on paper”, its enforcement is the most concerning.

We believe that this law was passed in order to attract international businesses, especially in the new technologies field and to keep up with other Gulf countries, just like the UAE.