June 5, 2023

Volume XIII, Number 156


June 04, 2023

Subscribe to Latest Legal News and Analysis

June 03, 2023

Subscribe to Latest Legal News and Analysis

New GCC Rules for Employers, Part 3 – Revised KSA Personal Data Protection Law (KSA)

The Kingdom of Saudi Arabia has issued legislation to regulate the collection and processing of personal data in the country (the PDPL). While the law was originally due to come into force on March 23 last year, the enforcement date has been postponed until this March 17. In addition, further regulations that should clarify various aspects of the PDPL are expected imminently, perhaps this month.

Under the PDPL, employers will be required to implement a privacy policy and make it available to data subjects (their employees, for the most part) prior to the collection of their personal data. The PDPL sets out the minimum information that should be included in the privacy policy, including when personal data is collected directly from the data subject.

The PDPL recently underwent public consultation with a view to numerous changes to the legal text. Companies will have one year from the new enforcement date in which to ensure compliance. 

Based on the amended draft legal provisions arising out of the consultation for the PDPL, we understand that prior regulatory approval will not be required with respect to personal data exported out of the KSA to another country, provided always that the country being exported to has at least the same standards of data protection as the KSA.

In respect of the engagement of data processors, we understand that the regulations supplementing the PDPL will clarify any contractual protections/provisions which need to be included/accounted for as part of any arrangements with data controllers. 

As the PDPL carries penalties for breaches of the law reaching up to SAR5,000,000 (US$1,333,000) and, in certain cases, imprisonment, we recommend all companies operating in the Kingdom, or processing the data of individuals based in the Kingdom should commence the review of any data processing related activities and seek to implement changes as needed to ensure compliance with the PDPL. We can provide practical support on:

  • advising on the grounds/lawful basis on which employee data can be processed.

  • updating the data protection wording in your template contracts of employment to reflect the new rules.

  • reviewing and updating your data protection policies and privacy notices for staff. The PDPL encompasses a number of data privacy principles that must be adhered to for compliance with the law, particularly in cases where there are direct points of contact with data subjects. We would recommend that employees are provided with a privacy notice that explains the purpose and legal basis on which their data is processed, as well as containing information required by the law.

  • providing training to your workforce affected by the new obligations.

  • assisting with putting in place processes to deal with enhanced data subject rights.

  • putting record-keeping processing systems in place – companies will need record-keeping systems to identify what employee data is processed, the purpose of that processing, to whom the data is transferred and the legal basis on which the processing takes place. This may form part of a wider HR data processing review.

  • ensuring your procedures for handling data subject access requests have been updated.

We can support your company in dealing with these issues. We can tailor our approach, and the level of support we provide, adapting this to fit with your existing GDPR compliance.

© Copyright 2023 Squire Patton Boggs (US) LLPNational Law Review, Volume XIII, Number 82

About this Author

Sarah Lawrence Dubai Employment Attorney Squire Patton Boggs

Sarah Lawrence is a UK qualified employment lawyer practising in Squire Patton Boggs' Dubai office.

Sarah is described by clients as “an exceptional lawyer” (Chambers & Partners Global) and “a trusted business advisor to her clients – she is particularly responsive and gives crisp advice,” (The Legal 500). Sarah advises multinational and regional clients (including across the GCC and the wider Middle East) on all aspects of labour law and employment and immigration issues both onshore and within the region's free zones,...

Habib Saeed Labor Attorney Squire Patton Boggs Dubai

Habib Saeed is a UK-qualified employment lawyer based in the Dubai office.

He deals with a wide range of employment issues on a daily basis, dedicated to resolving client issues in the workplace. Habib acts for multinational and regional clients in the UAE on all aspects of labour law, employment and immigration issues both onshore and within the region’s free zones, including the Dubai International Financial Centre and Abu Dhabi Global Market.

Habib has experience in handling labour law claims across the UAE, drafting and negotiating settlement agreements, senior executive...

971 4 447 8736