On Sept. 14, 2023, the amended Saudi Personal Data Protection Law (PDPL) will take effect. In 2021, the original law was published in the official gazette 720 days later. According to sources, the executive regulations supplementing the PDPL will be issued prior to this date.

A series of 27 amendments to the law were approved by the Council of Ministers. A royal decree issued on March 27 implemented the new amendments.

Saudi Data & Artificial Intelligence Authority (SDAIA) published a consultation paper in November 2022 proposing some amendments to the PDPL, but not all of those proposals have been implemented. As a result of the amendments, the PDPL will align more closely with international standards, such as the EU General Data Protection Regulation.

The amendments included those related to sensitive data, rights of the owner of personal data, and access periods. The amendments prevent controlling parties from collecting personal data except from their owners. There will, however, be some exceptions.

Additionally, the amendments required the controlling authority to adopt a privacy policy and make it available to owners of personal data for viewing, and not to disclose the data without their consent. Moreover, there are amendments regarding the leakage of personal data or the need to transfer it outside the Kingdom. As a result of the amendments, some terms in the law have been redefined, such as destruction, disclosure, and sensitive data.

The law was amended to give the owner of personal data the right of access to his data in accordance with the controls and request for it to be readable and clear. Data owners may also request its correction or updating, as well as the destruction of those data that are no longer needed, from the control authority.

The amendment in Article 20 of the law stresses the importance of the control authority notifying the competent authority when it is aware of data leakage, damage, or illegal access to it, and notifying the data owner if such a leak damages his data or conflicts with his rights or interests.