{"id":254804,"date":"2021-09-28T11:30:10","date_gmt":"2021-09-28T06:00:10","guid":{"rendered":"https:\/\/www.scconline.com\/blog\/?p=254804"},"modified":"2021-09-28T10:40:39","modified_gmt":"2021-09-28T05:10:39","slug":"saudi-arabia-royal-court-publishes-new-personal-data-protection-law","status":"publish","type":"post","link":"https:\/\/www.scconline.com\/blog\/post\/2021\/09\/28\/saudi-arabia-royal-court-publishes-new-personal-data-protection-law\/","title":{"rendered":"Saudi Arabia | Royal Court publishes new Personal Data Protection Law"},"content":{"rendered":"

On September 24, 2021, the National Centre for Documents and Archives Royal Court published the new Personal Data Protection Law (‘PDPL’), implemented by Royal Decree M\/19 of 17 September 2021<\/a> in the Official Gazette.<\/p>\n

\n

Applicability:<\/strong><\/p>\n

It is applicable to the processing of personal data by companies or public entities, by any means, that takes place in the Kingdom of Saudi Arabia, including the processing of personal data relating to residents of the Kingdom by companies located outside the Kingdom.<\/p>\n

 <\/p>\n

Data Protection Authority:<\/strong><\/p>\n

The Saudi Data & Artificial Intelligence Authority (‘SDAIA’) will be in charge of supervising and enforcing the implementation of the PDPL for the first two years, after which it may consider transferring the supervisory role to the National Data Management Office, the regulatory arm of SDAIA.<\/p>\n

\n

Effective date:<\/strong><\/p>\n

Article 43 of the PDPL provides that the law shall take effect 180 days after the date of its publication in the Official Gazette i.e. it will come into effect\u00a0 from 23 March 2022.<\/p>\n

Note: The effective date shall be delayed for a period of up to five years, and as determined by SDAIA, for companies located outside the Kingdom that process personal data of Saudi Arabian residents.<\/p>\n

\n

Duties of Data Controller:<\/strong><\/p>\n

Controller is required to do the following:<\/p>\n