Saudi Arabia Data Protection Law

Copyright © 2024 LexisNexis. All rights reserved.

Introduction

Saudi Arabia Cabinet Decision No. 98/1443 Personal Data Protection Law (Saudi Arabia Royal Decree No. M19/1443 On the Approval of the Personal Data Protection Law), was initially issued on 16 September 2021 and subsequently amended in March 2023 by Saudi Arabia Cabinet Decision No. 604/1444 (Saudi Arabia Royal Decree M148/1444). However, it only came into force on 14 September 2023, accompanied by a one-year grace period for organisations to achieve compliance, which ended on 14 September 2024.

In Saudi Arabia, the protection of personal data is governed by:

  • Saudi Arabia Cabinet Decision No. 98/1443 (Saudi Arabia Royal Decree No. M19/1443);

  • Saudi Arabia Royal Order No. A90/1412 On the Promulgation of the Basic Law of Governance;

  • Saudi Arabia Cabinet Decision No. 219/1426 On the Approval of the Labour Law (Saudi Arabia Royal Decree No. M51/1426 Approving the Labour Law);

  • Saudi Arabia Governor Decision No. 514/1441;

  • Saudi Arabia Cabinet Decision No. 79/1428 On the Approval of the Anti-Cyber Crime Law (Saudi Arabia Royal Decree No. M17/1428 Related to the Approval of the Anti-Cyber Crime Law);