The regulatory framework for protecting personal data in the Kingdom of Saudi Arabia and its impact on the obligations of technical authorities

Abstract

This study aimed to analyze the legal framework for personal data protection in the Kingdom of Saudi Arabia, established by Royal Decree No. (M/19) dated 9/2/1443 AH and amended by Royal Decree No. (M/148) dated 5/9/1444 AH, focusing on its legal and operational impact on the obligations of data controllers and processors (technical entities), through a comparative study with the European Union General Data Protection Regulation (GDPR). The study adopted the analytical-comparative methodology, examining the legislative texts of the Law, its Executive Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom, comparing them with the corresponding provisions in the GDPR, drawing upon contemporary legal scholarship and empirical studies.

The research was organized into two main chapters: the general provisions of the Law (conceptual framework, scope of application, governing principles, and data subject rights), and the obligations of technical entities (legal and organizational, technical and security, cross-border transfer controls, and the liability and criminal protection regime).

The study concluded with several key findings, most notably: the Saudi Law represents a qualitative legislative leap aligned with Saudi Vision 2030; the Saudi legislator adopted an expanded conception of sensitive data that exceeds its European counterpart in certain aspects; the Law's extraterritorial application reinforces the principle of digital sovereignty; and the Saudi sanctions regime emphasizes criminal penalties including imprisonment, contrary to the GDPR which prioritizes administrative sanctions with substantial monetary fines. The study also identified a persistent gap between the legislative text and practical implementation, particularly regarding compliance of Saudi websites and digital applications with transparency and privacy-by-design requirements.

The study recommended the issuance of specialized sectoral guidelines by the Saudi Data and Artificial Intelligence Authority (SDAIA), activating ex-post supervision of technical entities, publishing a list of countries with adequate protection modeled on the European adequacy decisions, developing specialized judicial and prosecutorial capacities, strengthening safeguards for the independence of the Data Protection Officer (DPO), and establishing a specialized regulatory framework for data processing in the context of artificial intelligence technologies.