Photographing and copying official identity documents

What the source says

The Personal Data Protection Law makes it the starting point that official documents identifying a data subject may not be photographed or copied. The two exceptions in article 28 are where this is done to carry out a law, or at the request of a competent public body in line with the regulations. The rule is addressed to the controller, meaning the party that decides why and how personal data is processed.

The law was issued by Royal Decree M/19 dated 9/2/1443 AH and amended by Royal Decree M/148 dated 5/9/1444 AH. Article 43 makes it effective 720 days after publication; the page we read does not give the actual date.

In practice, asking someone for a copy of an identity document just to register them or keep a file, where no law requires it and no public body has asked for it, is a practice to avoid.

When it matters to you

If you are an organisation collecting client data, ask before requesting an ID image: does a law require it, or has a public body asked for it? If not, take only what is actually needed, such as a number or a verification reference. If you are a data subject, you are entitled to ask why a copy of your ID is being requested.

What this article does not cover

We did not find the difference between photographing for an immediate check and keeping a copy settled in what we read, which is why collecting a copy merely for registration is best avoided. The article 28 meant here is in the law, not an article with the same number in the implementing regulation. This is general information from a published source, not legal advice; official decisions and procedures take place on the authority's platform.