The Personal Data Protection Law of Saudi Arabia (“KSA”) was recently amended pursuant to Royal Decree No. M/148, dated 05/09/1444H (corresponding to 27 March 2023G) (“Amended PDPL”). These amendments were preceded by a public consultation launched by the Saudi Data and Artificial Intelligence Authority in late 2022.
The Amended PDPL expands the scope under which Controllers could collect personal data from third parties, and process it for purposes other than that for which it was originally collected. It also provides additional grounds for Controllers to disclose personal data, and introduces an updated regime for personal data transfers outside of KSA.

On 10 March 2022, the National Data Management Office (NDMO) published for consultation a draft of the executive regulations (“Regulations”) to the Personal Data Protection Law, promulgated by Royal Decree No. M/19, dated 09/02/1443H (PDPL). The consultation invites comments on the Regulations and will close on 25 March 2022. The timing suggests that the publication of the final version of the Regulations is likely to occur later than the previously advised date of 23 March 2022.

On 24 September 2021, the long anticipated Personal Data Protection Law, promulgated by Royal Decree No. M/19, dated 09/02/1443H (corresponding to 16 September 2021), was published in the Saudi Official Gazette. The Law was developed by the Saudi Data and Artificial Intelligence Authority, which will be the competent governmental authority to administer the Law for a period of two years but it may thereafter transfer such competence to the National Data Management Office.