On September 1, 2024, the Saudi Data and AI Authority (SDAIA) unveiled significant updates to the regulations governing the transfer of personal data outside Saudi Arabia. These updates amend the earlier regulations established under the Personal Data Protection Law (PDPL), issued by Royal Decree No. (M/19) dated 9/2/1443 AH and amended by Royal Decree No. (M/148) dated 5/9/1444 AH. This article provides an in-depth analysis of these new regulations, their key changes, and what businesses need to know to ensure compliance.

Overview of the Data Transfer Regulations

The updated Data Transfer Regulations bring forward several changes from the previous version, reflecting a more streamlined approach while maintaining core data protection principles. Here’s a detailed look at these changes:

1. Reduction in Safeguards:

One of the most notable changes is the reduction in the number of safeguards recognized for data transfers. Previously, there were four types of safeguards available to ensure data protection when transferring personal data outside Saudi Arabia. These included Binding Codes of Conduct, Standard Contractual Clauses, Binding Common Rules, and Certificates of Accreditation.

Under the new regulations, “Binding Codes of Conduct” have been removed as an acceptable safeguard. The remaining three safeguards are:

• Standard Contractual Clauses (SCCs): These are legal contracts between data exporters and importers that ensure personal data is protected in accordance with Saudi laws.
• Binding Common Rules (BCRs): These rules apply to groups of entities operating under shared control and ensure that data protection measures are consistent across all members of the group.
• Certificates of Accreditation: These are certifications issued by recognized bodies that verify a company’s compliance with data protection standards.

2. Data Minimization Exemption:

Another significant change is related to the principle of data minimization. Previously, the PDPL required that personal data transferred outside Saudi Arabia be limited to the minimum necessary amount. Under the new regulations, controllers relying on one of the three approved safeguards (SCCs, BCRs, or Certificates of Accreditation) may not need to adhere strictly to this principle. This adjustment simplifies compliance for organizations that use these safeguards.

3. Revised Risk Assessment Requirements:

Risk assessments are a crucial aspect of data transfer regulations, ensuring that potential risks associated with data transfers are identified and mitigated. The updated regulations narrow the scope of risk assessments compared to the previous version. Risk assessments are now required in the following scenarios:

• When implementing an appropriate safeguard (SCCs, BCRs, or Certificates of Accreditation).
• When transferring sensitive data to entities outside Saudi Arabia on a continuous or widespread basis.

The broader requirement to conduct risk assessments whenever an appropriate safeguard is not in place has been removed. This change aims to reduce the compliance burden while maintaining a focus on high-risk data transfers.

For more details, view the Data Transfer Regulations here.

Key Points on Appropriate Safeguards

Binding Common Rules (BCRs):

The new BCR Guidelines issued by SDAIA provide a comprehensive framework for developing Binding Common Rules. BCRs are particularly relevant for multinational organizations or groups of entities operating under shared control. Key aspects of BCRs include:

• Controller Obligations: BCRs must clearly outline the obligations of data controllers, including compliance with the PDPL, handling data subject rights, and managing data breaches.
• Data Subject Rights: BCRs should detail the procedures for ensuring that data subjects can exercise their rights, such as access, correction, and deletion of their data.
• Compliance and Cooperation: The BCR Guidelines emphasize the need for maintaining accurate records of BCR members, processors, and sub-processors. Additionally, the guidelines require that the group of entities cooperate with Saudi authorities and adhere to local data protection laws.

Organizations must ensure that their BCRs are updated to reflect these guidelines and are consistent with the PDPL requirements. For more information on BCRs, visit the BCR Guidelines here.

Standard Contractual Clauses (SCCs):

The updated SCCs play a crucial role in ensuring that personal data transferred outside Saudi Arabia is protected to the same extent as under the PDPL. Key points regarding the SCCs include:

• Versions of SCCs: There are four versions of SCCs available, tailored to different data transfer scenarios:
  • Controller to Processor
  • Controller to Controller
  • Processor to Controller
  • Processor to Processor
• Each version addresses specific relationships and responsibilities between the parties involved in the data transfer.
• Compliance with Saudi Laws: The SCCs include provisions requiring data importers to comply with Saudi data protection laws. This includes submitting to Saudi legal jurisdiction and enforcing binding decisions under Saudi regulations. This requirement may impose additional compliance responsibilities on international data importers.

Organizations must ensure that their contracts incorporating SCCs align with these requirements. The Standard Contractual Clauses can be found here.

You May Also Read: Compliance with Saudi Arabia’s Personal Data Protection Law (PDPL)

Additional Rules and Guidelines

SDAIA has also released several additional rules and guidelines to support organizations in complying with the PDPL. These include:

1. Rules for Appointment of Personal Data Protection Officers:

These guidelines provide a framework for appointing Data Protection Officers (DPOs) within organizations. They outline the DPO’s roles and responsibilities, including overseeing data protection compliance, conducting audits, and serving as a point of contact for data subjects and regulatory authorities.

2. Privacy Policy Development Guidelines:

Organizations are required to develop and maintain comprehensive privacy policies that comply with the PDPL. The guidelines provide detailed instructions on what to include in privacy policies, such as data collection practices, data subject rights, and procedures for handling data breaches.

3. Minimum Personal Data Determination:

This guideline assists organizations in determining the minimum amount of personal data necessary for processing purposes. It ensures that data minimization practices are followed, aligning with the updated regulations on data minimization exemptions.

4. National Register of Controllers Rules:

The rules for maintaining the national register of data controllers include requirements for registration, record-keeping, and reporting. Organizations must ensure that their data processing activities are accurately recorded and reported to the relevant authorities.

5. Personal Data Destruction, Anonymization, and Pseudonymization Guidelines:

These guidelines provide procedures for securely destroying, anonymizing, or pseudonymizing personal data. Organizations must follow these procedures to ensure that data is handled in a manner that protects individuals’ privacy.

6. Personal Data Disclosure Guidelines:

Guidelines on data disclosures outline the conditions under which personal data can be disclosed, including requirements for consent and legal obligations. Organizations must adhere to these guidelines to ensure that data disclosures are compliant with the PDPL.

7. Personal Data Processing Activities Records:

Organizations are required to maintain detailed records of their data processing activities. This includes documenting data processing operations, purposes, and security measures.

Access these additional rules and guidelines here.

You May Also Read: Saudi Arabia Updates Investment Law to Attract Global Investors and Strengthen Confidence

Impact on International Businesses

The new regulations and guidelines have several implications for international businesses:

• Increased Compliance Burden: International data importers will need to ensure compliance with Saudi data protection laws, potentially increasing operational complexity and costs. Companies may need to update their data protection practices and documentation to meet these new requirements.
• Adaptation to New Safeguards: Organizations that transfer data outside Saudi Arabia must adapt to the updated safeguards and adjust their data transfer agreements and practices accordingly. This may involve renegotiating contracts and implementing new compliance measures.
• Enhanced Data Protection Measures: The emphasis on robust data protection measures under the new regulations means that organizations will need to invest in enhanced data protection practices. This includes updating privacy policies, conducting risk assessments, and ensuring that data processing activities are well-documented.

The recent updates to Saudi Arabia’s data transfer regulations mark a significant shift in the country’s approach to data protection. By reducing the number of safeguards and revising risk assessment requirements, the regulations aim to streamline compliance while maintaining a strong focus on data protection.

For businesses operating internationally, these changes will require careful review and adjustment of data transfer practices. It is essential to stay informed about these regulations and seek expert advice to ensure compliance.

For any questions or assistance regarding these updates and their impact on your business, please contact our team at Batic Law Firm. Our experts are here to help you navigate these changes and ensure that your data transfer practices comply with the latest regulations.