New amendments under Saudi Arabia’s Personal Data Protection Law

The Kingdom of Saudi Arabia is introducing new amendments to its as yet unenacted Personal Data Protection Law (Data Protection Law or the Law), a new law that comes into force on 14 September 2023. The amendments broaden the basis on which companies can collect, process and review non-sensitive personal data to include a company’s “legitimate interests” (marking a shift away from excessive reliance on a data subject’s consent). The amendments also make it possible, with the data subject’s agreement, to transfer data to an acceptable jurisdiction outside of Saudi Arabia.

Why do the amendments matter?

Data protection and privacy regulations are important to how Saudi business operates, including how companies monitor employees and carry out internal investigations. The amendments are welcomed because they temper what would otherwise be quite a restrictive data protection regime and give companies greater flexibility to process and transfer personal data where appropriate procedures are in place, like the EU’s General Data Protection Regulation (GDPR). Companies will have 12 months (from when the Law comes into force on 14 September 2023) to comply with the overall Law.

Scope of the Law and amendments

The Law and its amendments apply broadly to the processing of any data collected within Saudi Arabia that make the data subject (or their family, including deceased persons) personally identifiable.

While not...

Read Full Story: https://news.google.com/rss/articles/CBMiU2h0dHBzOi8vd3d3LmxleG9sb2d5LmNvbS9s...