The Kingdom of Saudi Arabia has enacted a new comprehensive data protection law (the PDPL), which comes into force on 23 March. The first standalone data protection law of its kind in KSA, the PDPL is a significant development and seeks to develop the Kingdom’s legislative landscape in a way consistent with its 2030 Vision to develop a digital infrastructure and grow a digital economy.
Supplementary regulations, some yet to be published, will provide additional guidance in respect of the practical application of the PDPL, including specific rules relating to the lawful transfer of data outside of KSA. I have set out below an overview of the key practical takeaways for employers in the Kingdom from the new law.
The PDPL applies to any processing by businesses of personal data performed in KSA by any means whatsoever, including the processing of the personal data of KSA residents by entities outside the Kingdom. In practice, a company can therefore be caught by the PDPL even if it is not established in KSA but is selling goods or services to KSA-based customers, or if data relating to employees within the Kingdom is processed outside it, for example at a corporate HQ in another country. As below, it is currently unclear how far this will be permitted anyway – there has been mention of a permit that will allow employers to process data elsewhere but how and when this will be formalised remains to be seen.
Action: Foreign companies will need to consider how...
Ryan Amacher, who played role in bid to damage campaign, has also made antisemitic and racist posts on social media An influencer who played a key role in hoax claims that James Talarico was in a ...