Arabian Rights: Saudi Arabia Introduces Data Protection

On 23rd March 2022 Saudi Arabia introduced its first personal data protection law.

Why Is Saudi Arabia Bringing In Data Protection Laws Now?

The Saudi Arabian government is enacting this Law because it aligns with its goals under the Saudi Vision 2030 which laid the foundation for the country’s future and set out its ambitions including:

• Strengthening the Kingdom’s economic position
• Moving away from its dependency upon commodities such as oil
• Raising spending levels on weapons, artillery and manufacturing,
• Advancing and nurturing the digital aspect of its economy by Introducing data protection requirements

So What Is This New Law and What Will It Cover?

The Personal Data Protection Law is being introduced as a cornerstone of Saudi Arabia’s 2030 vision and nobody should underestimate it. The new law potentially affects organisations processing and transferring data from Saudi Arabia to external countries. Data Owners will receive a raft of new rights relating to their personal data such as a right:

• of access
• to rectification, and
• to erasure.

Persons will also be able to complain to a ‘competent authority’. The new rules to apply to any personal information processed internally or externally to Saudi Arabia by commercial organisations, regardless of how processed and despite a business not being physically located in Saudi Arabia. It is questionable how this arrangement will work. The Kingdom clarified that the new rules may apply to external businesses transacting with Saudi-based consumers and where information pertaining to business employees is processed externally to Saudi Arabia at a head office located in another country. However, Habib Saeed from Squire Paton Boggs Solicitors suggested that a permit scheme may be introduced but commented that more clarity is required about how the rules will operate.

The new rules will oblige businesses to provide evidence that they have received informed consent to the processing of Personal Data and this will be required at the beginning of a commercial relationship. The Kingdom also want to ensure compliance with this new rule by introducing the requirement for systems to be in place to gather, store and hold evidence of informed consent.

There will be a new legal obligation placed upon employers who are classified as controllers of data to introduce and disclose privacy policies during the recruitment process and to those currently working for companies. Such policies must communicate why personal data will be gathered and its intended use. Habib Saeed from Squire Paton Boggs Solicitors advised those affected to disclose, ‘the more information, the better’.

Finally, there will tougher record-keeping requirements. The Kingdom is introducing a national registry of employers and data controllers. Lawyers need to be advising affected parties to follow the registration process and pay the £20,000 registration charge to the new regulator. Those registered will be obliged to provide:

• full written evidence of personal data processed or contemplate processing,
• the reasons for processing,
• detail the parties the data has been disclosed to,
• information on the time the data will be held, and
• Whether the data has been transferred and processed external to Saudi Arabia.

How Can Lawyers Be Preparing Their Clients Ahead Of The New Legal Requirements?

Lawyers should be advising their clients to consider the new rules carefully due to the serious consequences once enacted as non-compliance will attract criminal sanctions such as fines and custodial prison sentences. Affected businesses need to urgently review their how they process data and how they intend to comply with the requirements of the Data Protection law to prepare for when it is in force.

ASSESSING FIRMS

#SquirePatonBoggs #LinklatersLLP #HuntonAndrewsKurth #HoganLovells ##Fieldfisher #Bristows #Birsd&Bird #Allen&Overy #BakerMcKenzie #CMS #Covington&Burling #Dentons #DLAPiper #EvershedsSutherland #Latham&Watkins #NortonRoseFulnbright

THE ARTICLE WAS WRITTEN USING THE FOLLOWING SOURCES

[1] Royal Decree – No. M19/1443 (Cabinet Decision No.98/1443

[2]Saeed, Habib – Saudi Arabia’s new personal data protection law – key points for employers – 14 March 2022 - Saudi Arabia’s new personal data protection law – key points for employers | Employment Law Worldview

[3] Saudi Vision 2030 - Saudi Vision 2030 - Wikipedia

[4] Graf, Schluter – KSA’s New Game Changing Personal Data Protection Law – 18 January 2022 - KSA's New Game Changing Personal Data Protection Law - Lexology

[5] Personal Data Protection Interim Regulations

[6] Data Sharing Interim Regulations

[7] Khanachet, Tarek – Saudi Arabia Issues New Personal Data Protection Law – 9 December 2021 - Saudi Arabia Issues New Personal Data Protection Law | Inside Privacy

[8] Stephen, Ruth – Saudi data protection reform to take effect in March 2022 – 5th October 2021 - Saudi data protection reform to take effect in March 2022 (pinsentmasons.com)