Transferring personal data outside the Kingdom
The Personal Data Protection Law permits transfer outside the Kingdom on conditions, which the transfer regulation details: a list of countries with an adequate level of protection, appropriate safeguards where there is none, and a risk assessment in defined cases.
Who it applies to
Organisations that process individuals' personal data and use services or tools that process it outside the Kingdom.
The conditions in the law
Article 29 of the Personal Data Protection Law sets the conditions for transferring data outside the Kingdom or disclosing it abroad: a legitimate purpose, no prejudice to national security or the Kingdom's vital interests, an adequate level of protection outside it, and limiting the data to the minimum the purpose needs. The transfer regulation, whose published page at the Saudi Data and AI Authority was read, sets out the details.
What the transfer regulation adds
Article 3 of the transfer regulation refers to a list published by the Authority of countries with an adequate level of protection. Where there is none, appropriate safeguards apply under Article 4 of the transfer regulation: standard contractual clauses, binding common rules or a certification. Articles 2 and 4 of the transfer regulation allow transfer to provide a service or direct benefit to the data subject as an exception to two of the conditions, but with appropriate safeguards and not for sensitive data. Article 7 of the transfer regulation requires a written risk assessment before transfer if the exceptions are relied on or the transfer is continuous, wide in scope or involves sensitive data. Under Article 5 of the transfer regulation the controls extend to onward transfers by the recipient.
Who it matters to and what to do
The article matters to any organisation using a hosted service or software that processes data outside the Kingdom: property managers who store tenant data, associations, and providers using cloud tools. Before you begin, record what personal data is sent, to which entity, in which country and for what purpose, and keep to the minimum. Do not send data that identifies individuals to an external tool until you have identified the legal basis for the transfer.
Thibrh's role, its limits and what you need from an official body and what this article does not cover
Thibrh takes these controls into account in designing its tools, and this article is a general explanation, not a ruling on any particular tool. The published list that Article 3 of the transfer regulation mentions was not found during the check, so no judgement should rest on a particular country appearing in it; consult it on the Authority's site when needed. Determining the basis for a transfer in your case is a legal question for a specialist or the Authority. This is general information from a published source, not legal advice; official decisions and procedures take place on the authority's platform.
Key points
- Transfer abroad requires a legitimate purpose, minimum data and an adequate level of protection (Article 29 of the law).
- Where the level is not adequate, appropriate safeguards apply (Article 4 of the regulation).
- A written risk assessment is required in cases including continuous or wide transfers (Article 7).
- The controls extend to onward transfers (Article 5).
Provisions referenced
- نظام حماية البيانات الشخصية، المادة 29
- لائحة نقل البيانات الشخصية خارج المملكة، المواد 2 إلى 7