The Personal Data Protection Law of Saudi Arabia (“KSA”) was recently amended pursuant to Royal Decree No. M/148, dated 05/09/1444H (corresponding to 27 March 2023G) (“Amended PDPL”). These amendments were preceded by a public consultation launched by the Saudi Data and Artificial Intelligence Authority in late 2022.
The Amended PDPL expands the scope under which Controllers could collect personal data from third parties, and process it for purposes other than that for which it was originally collected. It also provides additional grounds for Controllers to disclose personal data, and introduces an updated regime for personal data transfers outside of KSA.

On 20 November 2022, the Saudi Data and Artificial Intelligence Authority launched a public consultation on proposed amendments to the Personal Data Protection Law, promulgated by Royal Decree No. M/19, dated 09/02/1443H, which was originally published on 24 September 2021.
The public consultation will remain open up until 20 December 2022 and all organizations are invited to submit their comments by that date.