In a significant move towards safeguarding individual privacy and data security, Saudi Arabia's amended Personal Data Protection Law (PDPL) officially came into effect on September 14. This milestone marks the culmination of efforts to regulate data collection, processing, disclosure, and preservation, ensuring comprehensive data protection in the Kingdom.

Key Highlights of the PDPL:

Comprehensive Framework: The PDPL establishes a detailed framework for data processing standards, data subject rights, processing body obligations, data sovereignty, and penalties for law violations.

Data Definition: Personal data encompasses a wide range of information, including names, identification numbers, dates of birth, contact details, financial data, images, and more, all capable of identifying individuals directly or indirectly.

Sensitive Data: The law classifies sensitive data as information relating to an individual's racial or ethnic origin, religious, intellectual, or political beliefs, criminal and security data, biometrics, genetic data, credit data, health data, and data indicating parental information.

Genetic and Health Data: Genetic data pertains to unique genetic or acquired characteristics that identify an individual's physiological or health traits. Health data encompasses all aspects of an individual's health, be it physical, mental, psychological, or related to health services.

Data Collection: According to Article 10 of the PDPL, personal data may only be collected directly from its owner and processed for the purpose it was collected.

Legal Guardian Responsibility: Article 13 of the Executive Regulations emphasizes the role of the legal guardian in safeguarding the data of incomplete or incapacitated individuals.

Data Transfer: The regulations specify conditions for the transfer of personal data outside the Kingdom, outlining controls and procedures.

Disclosure and Protection: Article 16 identifies legitimate interests, including fraud prevention and network security, under which controlling agencies can process and obtain personal data. Article 15 details circumstances allowing the disclosure of personal data.

Penalties: Article 36 assigns jurisdiction for addressing violations and imposing penalties outlined in the law and its executive regulations.