The Saudi Council of Ministers approved, on 21 March 2023, amendments to the Personal Data Protection Law, implemented by Royal Decree M/19 of 17 September 2021 approving Resolution No. 98 dated 14 September 2021 ('PDPL'). In particular, the proposed amendments to the PDPL were previously introduced by the Saudi Data and Artificial Intelligence Authority ('SDAIA'), on 20 November 2022, where they were made subject to public consultation until 20 December 2022. More specifically, the proposed amendments introduce provisions for, among other things:

• the right to data portability;
• legitimate interests as a legal basis for processing in some particular circumstances;
• permitting the processing of personal data for marketing purposes where a clear mechanism is fixed to allow the target recipients to request the cessation of the processing;
• permitting data transfers outside Saudi in specific circumstances and in accordance with certain conditions; and
• a requirement to keep records of the operations performed on personal data and set rules to restrict access to such data.

You can read the press release here and the proposed amendments here.