Data Residency in Saudi Arabia: PDPL Compliance Guide

Introduction

Saudi Arabia's Personal Data Protection Law (PDPL) marks a significant step in the Kingdom's digital transformation under Vision 2030. Issued by Royal Decree in September 2021 and amended in March 2023, the PDPL establishes a comprehensive framework for personal data protection. With the Saudi Data and Artificial Intelligence Authority (SDAIA) overseeing implementation, the PDPL introduces data residency considerations that organizations operating in the Kingdom must understand.

Overview of the PDPL

The PDPL applies to all processing of personal data carried out within Saudi Arabia, as well as processing of personal data of Saudi residents by entities outside the Kingdom.

Key Definitions

• Personal Data: Any data that can directly or indirectly identify an individual
• Sensitive Data: Data revealing ethnic or tribal origin, religious or intellectual beliefs, criminal record, biometric or genetic data, health data, credit data, and location data
• Controller: The entity that determines the purposes and means of processing personal data
• Processor: The entity that processes personal data on behalf of the controller
• SDAIA: The Saudi Data and Artificial Intelligence Authority, responsible for PDPL oversight

Core Principles

The PDPL is built on principles that align with international standards:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Confidentiality and integrity

Data Residency and Localization

The PDPL originally included strict data localization requirements, but the March 2023 amendments introduced a more flexible approach.

Current Transfer Framework

Under the amended PDPL, personal data may be transferred outside Saudi Arabia under certain conditions:

Condition	Description
Adequate Protection	The destination country provides adequate data protection
Appropriate Safeguards	Sufficient safeguards are in place to protect the data
Limited Transfer	The transfer is limited to the minimum data necessary
Risk Assessment	A risk assessment demonstrates acceptable risk levels
Regulatory Approval	SDAIA has approved the transfer
Contractual Necessity	The transfer is necessary for contract performance
Public Interest	The transfer serves the public interest
Vital Interest	The transfer is necessary to protect the individual's vital interests

Adequacy Determinations

SDAIA has the authority to determine which countries and international organizations provide adequate levels of personal data protection. Organizations should monitor SDAIA publications for updates on recognized jurisdictions.

Sector-Specific Localization

Certain sectors in Saudi Arabia have additional data localization requirements:

• Financial Services: The Saudi Central Bank (SAMA) requires that financial institutions maintain data within the Kingdom or obtain approval for outsourcing arrangements
• Healthcare: The Saudi Health Council and Ministry of Health have requirements for health data storage
• Telecommunications: The Communications, Space, and Technology Commission (CST) has data retention and localization requirements
• Government Data: Government data is generally required to remain within Saudi Arabia
• Cloud Services: The National Cybersecurity Authority (NCA) has issued cloud computing regulatory frameworks with data residency provisions

Consent and Legal Bases

The PDPL provides several legal bases for processing personal data:

Consent Requirements

• Consent must be explicit, informed, and freely given
• For sensitive data, consent must be written or through an authenticated electronic means
• Consent may be withdrawn at any time
• The controller must make withdrawal as easy as giving consent

Other Legal Bases

• Compliance with a legal obligation
• Performance of a contract with the data subject
• Protection of the vital interests of the data subject
• Fulfillment of a legitimate interest of the controller (provided it does not override the data subject's interests)
• Public interest purposes
• Processing of publicly available data

Rights of Data Subjects

The PDPL grants comprehensive rights:

• Right to be Informed: Know about the collection and processing of their data
• Right of Access: Obtain their personal data held by the controller
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Destruction: Request destruction of personal data that is no longer needed
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Data Portability: Receive data in a structured, commonly used format
• Right to Object: Object to processing, including profiling

Obligations for Controllers

Privacy Notice

Controllers must provide data subjects with clear and accessible information about:

• Identity and contact details of the controller
• Purposes of processing
• Legal basis for processing
• Categories of data collected
• Recipients or categories of recipients
• Details of any cross-border transfers
• Retention periods
• Data subject rights

Data Protection Impact Assessment

Controllers must conduct impact assessments when processing is likely to result in high risk to data subjects, particularly when:

• Processing sensitive data on a large scale
• Systematic monitoring of public areas
• Using new technologies that may create high risk
• Profiling that has legal or significant effects on individuals

Breach Notification

Controllers must notify SDAIA and affected individuals when a data breach:

• Results in significant harm to data subjects
• Involves sensitive personal data
• Occurs at a scale that warrants notification

The notification must include the nature of the breach, categories of data affected, estimated number of affected individuals, likely consequences, and measures taken to address the breach.

Data Protection Officer

Organizations processing large volumes of personal data or sensitive data may be required to appoint a Data Protection Officer.

Penalties and Enforcement

The PDPL provides for significant penalties:

Violation	Maximum Penalty
General violations	SAR 3 million (approximately USD 800,000)
Disclosure of sensitive data	SAR 3 million and/or up to 2 years imprisonment
Transfer violations	SAR 3 million and/or up to 2 years imprisonment
Repeat offenses	Doubled penalties

The law also provides for:

• Warning notices
• Confiscation of funds obtained through violations
• Publication of violation decisions

NCA Cloud Computing Framework

The National Cybersecurity Authority has issued the Cloud Computing Cybersecurity Controls (CCC), which affect data residency:

• Cloud service providers must comply with NCA security standards
• Data classification determines the level of security controls required
• Certain categories of data may need to remain within Saudi Arabia
• Providers must undergo assessment and registration

Practical Compliance Steps

Step 1: Assess Your Data Processing Activities

Map all personal data processing in relation to Saudi residents:

• What data is collected
• Where it is stored
• How it is processed and by whom
• Whether it is transferred internationally

Step 2: Establish a Legal Basis

For each processing activity, identify and document the legal basis under the PDPL.

Step 3: Evaluate Cross-Border Transfers

For any data leaving Saudi Arabia:

• Check SDAIA adequacy determinations
• Conduct a risk assessment
• Implement appropriate safeguards
• Obtain regulatory approval if required
• Consider sector-specific localization requirements

Step 4: Implement Security Measures

Align with NCA requirements:

• Data classification
• Encryption at rest and in transit
• Access controls and identity management
• Security monitoring and incident response
• Regular security assessments

Step 5: Prepare for Data Subject Rights

Establish procedures for handling data subject requests, including access, correction, deletion, and portability.

How GlobalDataShield Supports PDPL Compliance

Saudi Arabia's evolving data protection landscape requires infrastructure that can adapt to changing requirements. GlobalDataShield enables organizations to enforce data residency within the Kingdom while maintaining the flexibility to comply with SDAIA's transfer framework, providing encryption, access controls, and audit capabilities aligned with NCA standards.

Conclusion

The PDPL represents Saudi Arabia's commitment to building a robust data protection framework as part of its digital transformation. While the 2023 amendments introduced greater flexibility for cross-border transfers, organizations must still navigate sector-specific localization requirements, SDAIA oversight, and NCA security standards. Proactive compliance planning and investment in appropriate data infrastructure are essential for operating successfully in the Saudi market.