The final Implementing Regulations are generally business-friendly and bring the law closer to the EU GDPR.

By Brian A. Meenagh and Lucy Tucker

The Saudi Data & AI Authority (SDAIA) recently issued the final Implementing and Transfer Regulations for the upcoming Personal Data Protection Law (PDPL), the first comprehensive data protection law in Saudi Arabia. This follows the publication of consultation drafts of the Implementing and Transfer Regulations in April 2023 (the Consultation Draft). The PDPL was issued under Royal Decree No. M/19 on 16 September 2021, and amended pursuant to Royal Decree No. M/148 on 27 March 2023.

The PDPL came into force on 14 September 2023; however, we do not expect enforcement activities until mid-September 2024 because its preambles include an additional one-year transition compliance period.

This article provides high-level comments on key topics in the PDPL and Implementing Regulations, with a focus on areas which deviate from the GDPR or which have recently been updated in the final Implementing Regulations.