Saudi Arabia: Council of Ministers approves new data protection law
The Saudi Arabian Data & AI Authority ('SDAIA') announced, on 14 September 2021, that the Personal Data Protection Law had been approved by the Council of Ministers. In particular, the announcement notes that the new law is designed to protect any personal data that may directly or indirectly identify users from collection and processing of such data without consent.
Furthermore, the SDAIA outlined that within the new Personal Data Protection Law, 'personal data' shall include, among other things, names, identification numbers, addresses, phone numbers, personal records, financial records, images, videos, or any other identifying data.
In addition, the law aims to ensure the privacy of personal data, to regulate the sharing of personal data, and to prevent the abuse of personal data.
The law is expected to be implemented within six months and it will take effect 180 days after it is released.
You can read the announcement here.
UPDATE (21 September 2021)
The President of the SDAIA, Dr. Abdullah bin Sharaf Al-Ghamdi, issued, on 14 September 2021, a statement on the Personal Data Protection Law. In particular, the President outlined that the law is aimed at contributing to the protection of rights in relation to the processing of personal data, regulating its sharing between entities, and preventing its misuse. Furthermore, the President highlighted that the following data subject rights will be provided for:
- right to information;
- right to access;
- right to request correction, update, and destruction;
- right to request restriction of processing;
- right to object; and
- right to withdraw consent.
Moreover, the SDAIA released, on 18 September 2021, a set of frequently asked questions ('FAQs') and their answers regarding the new data protection framework.