WEBVTT
00:00:13.919 --> 00:00:16.160
Welcome everyone to today's episode.
00:00:16.320 --> 00:00:22.320
It's the second episode in Privacy Engine series on international data protection legislation.
00:00:22.640 --> 00:00:32.320
We started off last week with the India Indian Data Protection Law, or what we call the Digital Personal Data Protection Act of 2023.
00:00:32.719 --> 00:00:40.240
And today we're looking at the Kingdom of Saudi Arabia's Personal Data Protection Law, or what we call the PDPL.
00:00:40.880 --> 00:00:53.039
We'll break down the law in terms of what it does, how it compares to the GDPR, and what organizations need to do if they are preparing to be compliant with the law.
00:00:53.359 --> 00:00:59.439
I'm joined, like I was last week, by my friend or my and colleague Katie.
00:01:00.079 --> 00:01:03.600
And like last week as well, we'll take we'll alternate the questions.
00:01:03.759 --> 00:01:08.159
So I'll start with the first question and then Katie will go on with the second question and so on.
00:01:08.319 --> 00:01:12.400
We have about 12 questions, like we did last week as well.
00:01:13.359 --> 00:01:25.680
So hopefully this podcast will take you on a journey where you'll get a clear, engaging tour of one of the most important data protection laws in the Gulf region.
00:01:47.200 --> 00:01:54.079
It sets out how personal data must be collected, used, stored, shared, and transferred.
00:01:54.239 --> 00:02:06.879
And it gives individuals really clear rights that are very similar to the GDPR as well, and places obligations, very formal obligations on organizations in terms of uh processing personal data.
00:02:07.040 --> 00:02:12.800
And it's similar to other global uh privacy laws like the GDPR.
00:02:12.960 --> 00:02:21.520
It was introduced as part of Saudi Arabia's Vision 2030 digital transformation, and that's that's we can talk about that later on.
00:02:21.759 --> 00:02:24.560
I have information here about it actually.
00:02:24.800 --> 00:02:34.479
But the Saudi Saudi Arabia's um Vision 2030 is essentially the kingdom's blueprint for economic and social transformation.
00:02:34.719 --> 00:02:38.479
Um and the digital innovation sits right at the center of this.
00:02:38.719 --> 00:02:47.680
So the idea is to shift the country away from purely oil-independent economy and build a modern, diverse, technology-driven society.
00:02:47.919 --> 00:02:59.599
Okay, so the country is rapidly expanding cloud services, AI, fintech, a digital government, and it has a massive smart cities project which is called NEOM.
00:02:59.759 --> 00:03:05.280
And NEOM is like Saudi Arabia's flagship future city project.
00:03:05.520 --> 00:03:10.879
It's huge and it's in the northwest of the country near the Red Sea.
00:03:11.039 --> 00:03:24.479
It was created as part of the Vision 2030, and it's not just a city, it's more of a cluster of developments that are meant to showcase the ultra-high-tech low-carbon urban living and what that could look like.
00:03:25.120 --> 00:03:31.680
So the total of the NEOM area is 26,500 square kilometres.
00:03:31.840 --> 00:03:34.479
So it's not like a city, it's more like a small country.
00:03:34.639 --> 00:03:36.000
So that's really exciting.
00:03:36.240 --> 00:03:43.360
So, you know, the the PDPL is a crucial part of that development for Saudi Arabia.
00:03:44.159 --> 00:03:48.479
So the law also attracts um helps to attract international investment.
00:03:48.560 --> 00:03:59.360
And before the PDPL, there was no unified data protection regime, which made global companies hesitant to process to come to the kingdom.
00:03:59.520 --> 00:04:08.960
The law, especially after its 2023 amendments, aligns more closely with international standards and creates a workable system for cross-border transfers.
00:04:09.120 --> 00:04:24.240
The PDPL also reinforces national data sovereignty, central oversight by the Saudi data and AI authority, reflecting Saudi's priorities around security, cultural norms, and responsible innovation.
00:04:24.399 --> 00:04:34.399
At the same time, it responds to growing public expectations by giving people their rights to their data, the right to access, the right to correct, the right to delete.
00:04:34.480 --> 00:04:37.600
And we look at those in more detail as we go through the podcast.
00:04:37.839 --> 00:04:50.319
And finally, the PDPL lays the groundwork for safe AI and data analytics, ensuring these technologies are developed within trusted, well, well-governed legal environment.
00:04:50.480 --> 00:04:59.199
And in short, it's not just a privacy law, it's a strategic foundation for Saudi Arabia's modern digital AI-driven future.
00:04:59.519 --> 00:05:02.879
Okay, so moving on to the next question then.
00:05:03.360 --> 00:05:05.360
Katie, this question is for you.
00:05:06.000 --> 00:05:12.240
Who does the PDPL apply to, both inside and outside of Saudi Arabia?
00:05:14.079 --> 00:05:17.120
So the Act does have quite a broad scope.
00:05:17.360 --> 00:05:32.480
It applies to any organization that processes personal data of individuals who are located inside the kingdom, whether the organization is physically in the kingdom or operating from abroad.
00:05:32.800 --> 00:05:35.600
They include public and private sectors.
00:05:35.920 --> 00:05:45.759
And again, something interesting we had from our previous talk about the Indian law, it does extend to deceased persons as well.
00:05:46.079 --> 00:05:53.519
But in this case, only to the extent that it could identify the individual or their family members.
00:05:53.839 --> 00:06:02.480
So that's kind of quite an interesting common thread in this law, actually, that reflects the local culture of that area.
00:06:02.720 --> 00:06:08.480
That kind of they have quite strong family identities and reputations there.
00:06:08.639 --> 00:06:13.439
So it's just interesting that that comes in through the data protection law.
00:06:13.680 --> 00:06:23.920
And so other than that small detail there, that it is basically identical to the to the territorial scope of GDPR.
00:06:24.240 --> 00:06:30.879
If you target or monitor people in Saudi Arabia, you have to abide by this law basically.
00:06:31.199 --> 00:06:35.040
Again, the GDPR only really applies to living individuals.
00:06:35.279 --> 00:06:40.079
So I'd say that's the that's the main thing in the material scope to look out for.
00:06:40.959 --> 00:06:41.839
Yeah, exactly.
00:06:41.920 --> 00:07:00.560
And we've seen that now, like you say, with the Indian law and now with the Saudi Arabian law, that it it considers deceased individuals as well in various different ways, but that was that's something that the GDPR has never never considered, you know, and even in the digital omnibus, it's not even thought about there.
00:07:00.879 --> 00:07:02.560
So that's interesting.
00:07:03.360 --> 00:07:06.959
It is I think that it reflects kind of culture, I think maybe.
00:07:07.920 --> 00:07:09.439
Yeah, yeah, I agree.
00:07:09.680 --> 00:07:24.560
I quite like that it extends to the extent that it could identify someone as well here, that it's kind of making that distinction, like it's kind of helping explain why we should maybe think about diseased persons' data.
00:07:25.199 --> 00:07:25.839
I agree.
00:07:26.079 --> 00:07:26.399
Yeah.
00:07:26.720 --> 00:07:30.160
And like you say, there's implications for the family, you know.
00:07:30.480 --> 00:07:30.720
Yeah.
00:07:31.759 --> 00:07:32.639
Oh, definitely.
00:07:32.959 --> 00:07:33.279
Yeah.
00:07:33.519 --> 00:07:41.120
Um so Maria, how does it actually define personal data?
00:07:41.439 --> 00:07:45.199
Does it have a special category data equivalent?
00:07:46.240 --> 00:08:00.879
Yeah, actually, so like the Indian Act last week, we saw that you know special category data doesn't exist in the Indian Act, but um here in the PDPL, there is a, you know, they do make that distinction.
00:08:01.120 --> 00:08:05.600
So the PDPL defines personal data in a very broad way.
00:08:05.759 --> 00:08:24.639
It includes any information that identifies a person directly or indirectly, um, not just names and ID numbers, but also behavioral data and device identifiers and employee employment details and location information can even be deemed as personal data.
00:08:24.879 --> 00:08:49.759
So any kind of information that can be linked back to the individual can be seen as personal data, which is interesting again because when you consider the digital omnibus, now they're looking to change the per the definition of personal data in the GDPR because they're they're now saying that certain pseudonyms certain pseudonymized data under the GDPR may not be covered by the GDPR.
00:08:49.919 --> 00:08:51.440
So that's that's interesting.
00:08:51.600 --> 00:08:54.159
So there's kind of like an opposite happening.
00:08:54.320 --> 00:09:03.039
Like, you know, the the PDPL is very broad in scope, and whereas the GDPR seems to be reducing it somewhat, you know.
00:09:03.360 --> 00:09:09.440
The law then goes further by creating a category of sensitive personal data which receives stronger protections.
00:09:09.600 --> 00:09:11.200
So again, like the GDPR.
00:09:11.279 --> 00:09:18.399
This includes health information, but it also includes financial data, which is not covered under the GDPR, special category data.
00:09:18.559 --> 00:09:27.120
It also includes genetic data, religious or philosophical beliefs, again like the GDPR, ethnic origin and security-related identifiers.
00:09:27.200 --> 00:09:29.279
So it's slightly different there from the GDPR.
00:09:29.519 --> 00:09:35.679
These categories are treated as high risk because misuse could cause harm or discrimination.
00:09:36.000 --> 00:09:41.200
They also reflect cultural and national considerations specific to Saudi Arabia.
00:09:41.440 --> 00:09:53.519
Like, for instance, biometric data like fingerprints and facial recognition, it's given stricter treatment with Saudi Arabia moving quickly into AI and digital identity and smart cities initiatives and so on.
00:09:53.679 --> 00:10:06.639
The PDPL requires organizations to apply very strong safeguards, obtain explicit consent in some cases, and conduct risk assessments before using biometric or genetic data, which is which is a good sign.
00:10:06.879 --> 00:10:14.799
Compared to the GPR, both GDPR, both laws treat sensitive and biometric data as requiring extra protection.
00:10:14.879 --> 00:10:31.200
So that's similar to the GDPR, but the PDPL does within a more centralized governance model focused on data sovereignty and national security, as opposed to you know what the GDPR would do, it's more like rights focused.
00:10:32.080 --> 00:10:38.480
So you could say, in this respect, the PDPL is more controlled or prescriptive.
00:10:39.360 --> 00:10:57.919
So, in short, the PDPL uses a broad definition of personal data, it treats sensitive and biometric categories as high risk and requires stricter safeguards when processing them, all reflecting the kingdom's priorities around trust and governance and um safe digital transformation.
00:10:58.399 --> 00:11:00.320
So Katie.
00:11:01.279 --> 00:11:01.919
Yeah.
00:11:02.879 --> 00:11:18.799
I was just gonna say I also when I was looking through it, I noticed one element of the sensitive category data was also data that indicated one or both of a data subject's parents are unknown.
00:11:19.200 --> 00:11:38.080
So I just thought that was another interesting reflection of kind of the cultural revel relevance of family backgrounds in the area, which again, like in the deceased individuals we've seen, reference to the family connections and then under the sensitive category data.
00:11:38.480 --> 00:11:48.480
I just you know they're kind of thinking about individuals in a wider context than individual which than the GDPR etc.
00:11:49.279 --> 00:11:58.639
Which and when you say when one of the parents is unknown, does is that does that then become a special category data or sensitive data?
00:11:59.519 --> 00:12:01.440
Or or how does that work?
00:12:02.399 --> 00:12:18.639
Well it said for the data that indicates one or both of the individuals' parents are one are unknown, was included in the article that defines sensitive category data.
00:12:18.799 --> 00:12:35.279
So I just think it's it's almost more community-based, like I don't know, then the European understanding of personal data, it kind of considers the impact community impact as rather than just the impact on the individual as well.
00:12:35.679 --> 00:12:36.399
Yeah, okay.
00:12:36.559 --> 00:12:48.080
So if an individual if if one of the parents is unknown, then that m may be sensitive within her environment or her community, so his community.
00:12:48.240 --> 00:12:58.960
So keeping that private would probably, yeah, probably um help them, you know, uh feel more comfortable in their in their uh in their community, maybe.
00:12:59.360 --> 00:12:59.519
Yeah.
00:12:59.919 --> 00:13:00.720
Yeah, yeah.
00:13:00.960 --> 00:13:04.720
That's what I was inter interested in another.
00:13:05.679 --> 00:13:08.639
Yeah, something different to the European perspectives, yeah.
00:13:08.720 --> 00:13:21.600
And so probably something that's important for their culture, that that obviously wasn't important enough for for it to be included in the GDPR, but yeah, that's interesting, uh an interesting distinction.
00:13:24.320 --> 00:13:32.559
Okay, so Katie, uh the next question for you is what are the main lawful bases for processing personal data under the PDPL?
00:13:32.720 --> 00:13:43.039
So last week again we saw the Indian uh the Indian uh Act or the PDPD of 2023 being quite different to the GDPR.
00:13:43.120 --> 00:13:52.799
So is the KSA similar to to uh the or the PDPL similar to the Indian law or is it more similar to the GDPR?
00:13:55.120 --> 00:13:58.240
Well, I'd I'd say it's a bit of both and neither.
00:13:58.399 --> 00:13:59.039
I don't know.
00:13:59.360 --> 00:14:06.879
So the PDPL is consent first, basically, which is flipped from the GDPR.
00:14:06.960 --> 00:14:23.440
I mean, I feel like it's actually the supervisory parties in Europe right now are kind of discouraging people from relying on consent as much because of you know the consideration for the fact that consent may not be freely given in a lot of cases.
00:14:23.759 --> 00:14:32.559
So consent is the is the main basis for processing personal data under the PDPL.
00:14:33.120 --> 00:14:38.960
Um but Article 5 does say it needs to be explicit, informed, and freely given.
00:14:39.200 --> 00:14:44.159
It does say that the data subject can withdraw the consent at any time.
00:14:45.039 --> 00:15:00.240
So I mean, I wouldn't really be consent if I suppose if you couldn't, but Article 6 then goes on to allow a couple of different situations where you do not need the consent of the data subject.
00:15:00.480 --> 00:15:36.000
Um they have the the vital interest basis, they have the actual interest of the data subject, they have legal obligations, contractual agreement, um for matters of security, uh judicial requirements, and they do have for the legitimate interest of the controller, but only where those interests do not harm individuals' rights or contradict the law's purpose.
00:15:36.799 --> 00:15:46.159
So they do have the concept of legitimate interest, but it is a bit narrower than the GDPR version now.
00:15:46.320 --> 00:15:58.639
It's only legal where there's no sensitive data as well, so they can't kind of mix legitimate interest for protest and sensitive data, and they do need to complete an assessment.
00:15:58.879 --> 00:16:09.679
So I mean, back to back, the GDPR encourages uh kind of taking a case-by-case basis when it comes to legal basis.
00:16:10.080 --> 00:16:14.559
They kind of don't want people to be relying on consent in every situation.
00:16:15.440 --> 00:16:25.679
Um the PDPL is basically backwards and saying, you know, consent first, and if you can't get it, then you need to fit into one of these other categories.
00:16:26.399 --> 00:16:38.799
So and I think it's interesting as well to say that you know, again, with the digital army bus coming down the line, legitimate interest is going to be widened under the GDPR and the EU AI Act.
00:16:38.960 --> 00:16:43.600
So I it would be really interesting to know, and I don't know this answer, but maybe we can look look into it.
00:16:43.759 --> 00:16:54.320
But it would be really interesting to know how uh Saudi Arabia or even India uh justifies the use, you know, processing of personal data in AI systems.
00:16:54.559 --> 00:17:15.519
Because under the GDPR now, um uh we we're seeing that they're saying that you know you could actually use legitimate interest for processing personal data in your AI systems, which in my opinion could cause a conflict of interest for the G DPO quite easily, you know, but that's another discussion.
00:17:15.759 --> 00:17:17.200
But yeah, it's it's interesting.
00:17:18.400 --> 00:17:20.160
Yeah, yeah.
00:17:21.519 --> 00:17:31.759
So so yeah, so the the in the in the PDPL legitimate interest does exist, but it's not as wide as the GDPR.
00:17:32.160 --> 00:17:32.720
That's interesting.
00:17:32.880 --> 00:17:38.160
Yeah, and you can't use uh sensitive uh data.
00:17:43.839 --> 00:17:46.240
We'll move on to the next question.
00:17:46.480 --> 00:17:51.759
Um so Maria, what rights do people have under the PDPL?
00:17:52.720 --> 00:17:53.440
Thanks, Katie.
00:17:53.599 --> 00:17:59.920
Well, I think again, so these are quite similar, in my opinion, to the GDPR.
00:18:00.319 --> 00:18:02.880
There, from what I can understand, there are six rights.
00:18:03.119 --> 00:18:11.359
So one of the key features of the Saudi PDPL is that it gives individuals a set, a clear set of data subject rights.
00:18:11.519 --> 00:18:23.839
Um, these rights are central to building trust in the digital services and supporting the kingdom's shift towards a modern accountable data ecosystem, like we were saying earlier on.
00:18:24.079 --> 00:18:36.880
So people have the right to be informed, which means organizations must clearly explain what data they're collecting, why they're collecting it, and how it will be used, and who it may be shared with.
00:18:36.960 --> 00:18:39.519
So that again, similar to the GDPR here.
00:18:39.680 --> 00:18:45.759
Privacy notices need to be transparent and accessible and not buried within legal jargon.
00:18:46.000 --> 00:18:49.519
Individuals also have the right to access their data.
00:18:49.759 --> 00:18:53.119
They can request a copy of the information an organization holds about them.
00:18:53.200 --> 00:19:04.720
So that again is like a data subject access request, which is especially important now that the that more services rely on cloud platforms and AI systems within the kingdom.
00:19:04.960 --> 00:19:18.480
They also have the so individuals also have the right to correct inaccurate or outdated data, which is crucial in in sectors like financial and healthcare, because you know you can have serious consequences in those two industries.
00:19:18.720 --> 00:19:24.799
The PDPL also recognizes a right to request deletion, but this is within limits.
00:19:24.880 --> 00:19:36.000
So people can ask for their data to be erased when it's no longer needed, but in certain situations, organizations may need to keep some information for legal or security reasons.
00:19:36.079 --> 00:19:38.880
So, again, that's very similar to GDPR there.
00:19:39.920 --> 00:19:52.160
Another significant protection is the right to restrict processing, something that we didn't see in the Indian Act of last week, but what it also exists in the GDPR.
00:19:52.480 --> 00:20:05.039
If someone believes that their data is being used unfairly or incorrectly, or if there's a legal process going on, then they can request the organization to pause processing until the issue has been resolved.
00:20:05.519 --> 00:20:16.799
There's also a growing expectation that individuals can challenge automated decision making, even though I don't think this is a right yet, but there is increased pressure in looking into this area.
00:20:17.039 --> 00:20:28.319
The PDP, the PDPL doesn't mirror the GDPR's article 22, but it does require transparency around profiling and automated decision making.
00:21:18.480 --> 00:21:31.359
In short, the PDPL gives individuals the right to be informed, to access their data, to correct it and to delete it under certain certain conditions, to restrict processing and to question automated decisions.
00:21:32.400 --> 00:21:41.519
And this is all aimed at increasing transparency, accountability, and public trust in Saudi Arabia's fast growing digital landscape.
00:21:43.359 --> 00:21:46.640
So next question now is for you, Katie.
00:21:47.039 --> 00:21:53.039
What obligations are organizations required to comply with under the PDPL?
00:21:54.880 --> 00:21:57.039
Um thanks for that, Maria.
00:21:57.279 --> 00:22:02.160
So they have A couple of different things to look out for.
00:22:02.319 --> 00:22:08.480
Um under Article eight, they need to do their due diligence with their processors.
00:22:08.799 --> 00:22:16.240
They need to basically make sure that their processors have an adequate level of compliance in relation to the law.
00:22:16.400 --> 00:22:20.400
So that's a responsibility on them, much like the GDPR.
00:22:20.480 --> 00:22:32.799
You know, you can't really claim ignorance as to what your subprocessors, how your subprocessors subprocessors are handling the data that you give to them.
00:22:33.119 --> 00:22:41.759
Um they need to implement uh accountability measures, ensure accurate and minimal data collection.
00:22:41.920 --> 00:22:46.880
They need to have technical and organizational security controls.
00:22:48.480 --> 00:23:14.160
They do need to maintain processing records, which not every international law imposes, and which even the GDPR is considering taking out for certain organizations, which I mean I think that maintaining processing records is kind of essential to every other thing that you do in relation to your compliance.
00:23:15.839 --> 00:23:20.720
I mean, it just it just takes more work off you at the at the end of the day.
00:23:20.799 --> 00:23:23.200
I mean it's easier.
00:23:23.519 --> 00:23:25.920
So yeah, they do have to do that.
00:23:26.160 --> 00:23:35.920
Um they have an obligation to uh train their employees, offer clear rights handling mechanisms for the data subjects.
00:23:36.160 --> 00:23:57.200
Um they do have impact assessments similar to DPIAs for high risk processing, new technologies, profiling or profiling, handling sensitive data, um, and then bridge notification obligations, which we'll kind of talk about further on, I think, in in a bit more detail there.
00:23:57.599 --> 00:24:04.240
So it's I mean it's quite identical to the GDPR there.
00:24:04.400 --> 00:24:17.119
Um the SETI enforcement does have a stronger emphasis on uh regulatory engagement, culturally specific expectations, like their notices have to be in Arabic.
00:24:18.079 --> 00:24:28.079
Um which I mean that's not so different when you consider that the GDPR notices have to be kind of intelligible.
00:24:28.559 --> 00:24:44.160
Um when you consider, I mean, the people who are who are going to be exercising their rights, you know, they need so I'd say yeah, it is it is it's almost one for one compared to the GDPR.
00:24:44.640 --> 00:24:54.640
You know how we saw last week as well with the Indian law that the data principal had certain obligations not to you know not to be vacatious and so on.
00:24:54.880 --> 00:25:05.279
Did do you have any idea whether that exists in the Saudi law, or is it very much like the GDPR in that it it doesn't seem to put any obligations on the data subject?
00:25:05.680 --> 00:25:07.359
Yeah, no, I don't I don't think they do.
00:25:07.440 --> 00:25:16.400
I think as far as those three laws, the Indian law is unique in imposing the obligation on the data subject, which I actually like that.
00:25:16.720 --> 00:25:17.200
I agree.
00:25:17.519 --> 00:25:18.640
That obligation.
00:25:19.200 --> 00:25:20.319
Yeah, um yeah.
00:25:20.640 --> 00:25:26.960
So Maria, what does the law say about international data transfers?
00:25:28.319 --> 00:25:34.319
So I think it again, so we look we saw in the Indian law last week, completely different to the GDPR.
00:25:34.559 --> 00:25:42.880
The Saudi, the PDPL, in my opinion, is much more like the GDPR in terms of the fact that it has adequacy requirements.
00:25:43.200 --> 00:25:51.839
So international data transfers are one of the areas where the Saudi PDPL has changed most, especially after the 2023 amendments.
00:25:52.079 --> 00:25:54.720
The original version of the law was very restrictive.
00:25:54.799 --> 00:25:59.839
It basically made it difficult for organizations to send personal data outside of Saudi Arabia.
00:26:00.000 --> 00:26:07.359
So but after 2023, they kind of made it more, they kind of made the act more or the PDPL more modern.
00:26:07.839 --> 00:26:19.599
Because before 2023 it caused issues for cloud services, multinational uh organizations, and and basically any kind of cross-border business uh business models.
00:26:20.000 --> 00:26:26.240
So the amended PDPL from 2023 is much more practical and aligned with global standards.
00:26:26.480 --> 00:26:34.079
Today, data can be transferred outside the kingdom, but only if proper safeguards are in place, and that's again similar to the GDPR.
00:26:34.240 --> 00:26:46.240
The core idea is simple: any personal data leaving Saudi Arabia must be protected to a level that isn't materially lower than what the PDPL guarantees inside the country.
00:26:46.400 --> 00:26:53.440
So, again, you can see that as kind of an adequacy agreement that you would have to put in place or you'd have to have with the GDPR.
00:26:53.839 --> 00:26:57.119
Or again, you know, standard contractual clauses.
00:26:57.279 --> 00:27:09.599
If you don't have an adequacy agreement, you'd have to get the standard standard contractual clauses in place to make sure that the data has the same level of protection outside as opposed to inside the country.
00:27:10.000 --> 00:27:14.079
There are a few ways organizations can meet that threshold.
00:27:14.160 --> 00:27:32.000
Uh, they can transfer data to a country that the data uh the Saudi authority has deemed adequate, or they can use strong contractual safeguards, again, similar to the SCCs in in Europe, like the PDPL compliant transfer agreements and that they have.
00:27:32.240 --> 00:27:42.960
And for very specific situations, such as fulfilling a contract or protecting someone's vital interests, the law allows for limited exceptions, which again are similar to the GDPR.
00:27:43.279 --> 00:27:49.839
So, what's unique about the PDPL is that its emphasis on the national data sovereignty.
00:27:50.160 --> 00:27:57.359
Organizations must show that the transfer is genuinely necessary and that they've limited the amount of data leaving the kingdom.
00:27:57.599 --> 00:28:09.680
The Saudi authority also keeps central oversight and can approve, restrict, or block these transfers, especially when sensitive categories or national security concerns are involved.
00:28:09.839 --> 00:28:17.440
So while the GDPR and the PDPL allow for international transfers based on adequacy, their philosophies are slightly different.
00:28:17.599 --> 00:28:33.359
The GDPR is driven by protecting fundamental rights, as we know, across the borders, while the PDPL focuses on ensuring that the data leaving the kingdom doesn't undermine the national governance or cultural or security priorities of the country.
00:28:33.680 --> 00:28:40.480
So, yeah, so kind of fundamental philosophical differences there between the two jurisdictions.
00:28:40.880 --> 00:28:47.839
Um so, Katie, tell us about the requirements for consent and privacy notices under the PDPL.
00:28:50.079 --> 00:28:55.839
Um okay, so I mean, as I said earlier, consent needs to be explicit.
00:28:56.400 --> 00:29:01.039
You need to obtain the consent before collecting or processing the data.
00:29:01.279 --> 00:29:07.920
Um and individuals need to be able to withdraw their consent at any time without negative consequences.
00:29:08.720 --> 00:29:21.599
I suppose without negative consequences, that kind of considers that point that the European perspective of why consent may not be appropriate in all circumstances.
00:29:22.240 --> 00:29:29.039
Um but so it's Article 12 and 13 that talks about the privacy notices in particular.
00:29:29.200 --> 00:29:33.440
Uh they need to be clear, accessible, and usually in Arabic.
00:29:34.240 --> 00:29:39.920
Um they need to be provided to data subjects prior to the collection of their data.
00:29:40.079 --> 00:30:02.400
And it needs to it needs to outline the controller's identity, the purpose of processing, the legal basis they're relying on, how long the data is going to be retained for, what rights they can exercise, whether the data is going to be disclosed to a third party, how someone can object or withdraw the consent.
00:30:03.200 --> 00:30:16.960
Um it needs to inform them of their right for complaint, and it also needs to explain whether the data is mandatory and what could happen if the data subject declines to share that information.
00:30:17.200 --> 00:30:33.680
So, you know, I suppose everyone might want to exercise their rights to not share data, but I mean in some circumstances that might actually have an effect on your experience of a particular service, so it's an interesting addition.
00:30:33.839 --> 00:30:40.799
But yeah, overall the transparency transparency expectations are quite similar to the GDPR.
00:30:41.759 --> 00:30:50.240
Um again the language emphasis, but I mean it's their country, their language at the end of the day.
00:30:50.799 --> 00:30:52.240
Absolutely, yeah.
00:30:53.359 --> 00:31:25.279
And it also requires that it needs to be accessible to individuals with varying levels of digital literacy, which I quite like because I mean I know just personally, some people in my life have never no concept of you know what the repercussions could be of giving their consent to something or withdrawing their consent, you know, and I you can't blame them either because it's just not everyone's you know ballpark.
00:31:25.440 --> 00:31:39.920
So absolutely, I I agree, and that sounds to me like the protections that are in place in the financial industry where if you sell an individual a financial product, you have to be sure that they understand what they're buying, you know.
00:31:40.160 --> 00:31:44.400
So, again, that would be kind of financial literacy and understanding what you're getting into.
00:31:44.559 --> 00:31:51.599
I think it's very similar in the digital age, like giving consent, but they have to understand what are they giving consent to.
00:31:51.920 --> 00:32:02.799
Like you can you can you can give them a whole load of jargon and kind of befuddle them and confuse them, and and you know, that's not explicit consent, in my opinion, you know.
00:32:03.119 --> 00:32:04.000
So I agree.
00:32:04.559 --> 00:32:09.920
Digital literacy is is essential in terms of making sure you have explicit consent.
00:32:10.079 --> 00:32:11.119
So that's a good point.
00:32:13.200 --> 00:32:17.599
Yeah, um that's quite quite a good point.
00:32:17.920 --> 00:32:22.400
So I'll move on to the next question for you here, Maria.
00:32:22.559 --> 00:32:28.240
How does the law treat AI profiling and automated decision making?
00:32:29.119 --> 00:32:43.920
Okay, so this is an interesting question as well because again, we've seen, like we've discussed it already, that you know, they're looking at Vision 2030, they're looking at smart cities, they're really jumping into digital identity and AI systems and so on.
00:32:44.160 --> 00:32:51.039
So, but it doesn't actually have the equivalent of the EU AI Act that we have in Europe at the moment.
00:32:51.359 --> 00:33:08.319
Um and so it doesn't have a kind of the PDPL as well as a data protection law doesn't have a kind of standalone AI chapter, but it still places clear rules uh around how AI profiling and automated decision making can use personal data.
00:33:08.480 --> 00:33:19.440
So, again, similar like to the GDPR, it's not it doesn't specifically give definitions of AI, but it talks about profiling, it talks about automated decision making.
00:33:19.680 --> 00:33:36.640
So data Saudi Arabia views AI as a major part of its vision 2030, like we said, and the PDPL is designed to support innovation, is is designed to support innovation while also setting boundaries around higher risks, uh higher risk uses.
00:33:36.720 --> 00:33:54.400
So, again, we saw that kind of balance in the Indian law last week, and so I think what what the the PDPL tries to do as well is to try and get that balance right between you know being innovative but also protecting the state as well as their citizens.
00:33:54.559 --> 00:34:14.559
So, under the PDPL, any AI system that processes personal data must follow the law's core principles, having a lawful basis, limiting processing to a specific purpose, collecting only what's necessary, so that's data minimization under the GDPR, and ensuring fairness, transparency, and security.
00:34:14.719 --> 00:34:26.000
These rules apply whether we're talking about basic analytics or advanced machine learning models in fintech, healthcare, and smart cities environments, so it's across the board.
00:34:26.320 --> 00:34:33.199
Profiling and an automated decision making are treated as potentially high-risk activities, which in my opinion they are.
00:34:33.440 --> 00:34:41.360
When AI is used to make decisions about people, such as hiring, credit scoring, eligibility assessments.
00:34:41.440 --> 00:34:52.480
Like we have again, we have a lot coming from the European Court of Justice in this area where they're trying to understand what is what is seen as automated decision making and what's not.
00:34:52.960 --> 00:34:55.119
There's been a number of cases.
00:34:55.280 --> 00:34:59.360
Um Shufa was one of them back in December 2023.
00:34:59.440 --> 00:35:08.000
There was another one in February of 2024 about a decision making and what can we understand as automated decision making.
00:35:08.159 --> 00:35:12.320
So again, the the the similar kind of issues are coming up.
00:35:12.639 --> 00:35:26.159
So hiring, credit scoring, eligible eligibility assessments or behavioral predictions against around you know the EU AI Act would ban some of those behavioural prediction AI systems.
00:35:26.480 --> 00:35:38.000
Organizations need stronger risk assessments, enhanced safeguards, and some degree of explainability so individuals understand how those how those automated decisions were made.
00:35:38.239 --> 00:35:48.239
Individuals have the right to know when automated processing is happening, and so they need notification around, you know, it's a it's an AI system that's processing their data.
00:35:48.400 --> 00:35:54.559
And in some cases, the right to challenge or correct decisions made solely by algorithms exist.
00:35:54.880 --> 00:36:03.679
The PDPL doesn't have a direct equivalent of the GDPR's article 22, like we said before, but the expectation is similar.
00:36:04.000 --> 00:36:09.119
Important automated decisions should not be completely opaque or unchecked.
00:36:09.199 --> 00:36:13.920
So you have to have that human human in the loop again, like with the GDPR.
00:36:14.079 --> 00:36:17.199
So biometric data adds another layer of obligation.
00:36:17.440 --> 00:36:24.480
So if you have biometric data, you know, they they they look at it more, there's more kind of obligations around that.
00:36:24.719 --> 00:36:33.760
If AI uses facial recognition or voice prints or other kind of biometric identifiers, the PDPL classifies this as especially high risk.
00:36:34.079 --> 00:36:47.519
That means stricter security controls, access rules, retention limits, and in many cases explicit consent, reflecting both national security.
00:36:47.679 --> 00:36:54.880
Again, the national security kind of comes up as well as the fundamental or the you know the human rights um and cultural sensitivity.
00:36:55.039 --> 00:37:03.840
So we're seeing a lot around the government, national security, and cultural differences that we've spoken we've spoken about throughout the podcast.
00:37:04.079 --> 00:37:08.719
Compared with the GDPR, the PDPL is slightly more governance-driven.
00:37:09.039 --> 00:37:27.199
The GDPR frames automated decision making primarily around individuals' rights, whereas the PDPL blends that with Saudi Arabia's national data sovereignty model, meaning some AI uses may face stronger central oversight.
00:37:27.679 --> 00:37:37.519
So, in short, the PDPL allows AI and pro it does allow AI profiling, but it regulates them through a principle-based, risk-based approach.
00:37:37.679 --> 00:37:47.840
Organizations must stay transparent, they have to justify their data use, protect sensitive data and biometric data, and maintain human oversight.
00:37:48.000 --> 00:37:51.519
So again, it's you know it is quite close to the GDPR.
00:37:51.599 --> 00:38:07.440
There are differences, and I would say philosophical differences as well, but it wouldn't be a huge jump for somebody that's been working in the GDPR to, you know, to to work with this law or to be, you know, to be compliant with the law as well.
00:38:08.480 --> 00:38:16.960
So, okay, so the next question then for you, Katie, is Does the PDPL require organizations to appoint a data protection officer?
00:38:17.039 --> 00:38:26.400
So again, we saw last week in India that a data protection officer only needs to be appointed when the data fiduciary is seen as significant.
00:38:26.559 --> 00:38:28.639
So for significant data fiduciaries.
00:38:28.880 --> 00:38:31.440
How about in the uh in the PDPL?
00:38:31.679 --> 00:38:32.159
What's that?
00:38:32.320 --> 00:38:33.199
What's that like?
00:38:34.000 --> 00:38:47.119
So yeah, some again, kind of like the Indian law, some controllers are going to need to appoint a DPO, and the per that's provided for under Article 30.
00:38:47.360 --> 00:38:49.199
Um, but there are conditions.
00:38:49.440 --> 00:39:05.440
So the conditions are where a company carries out large-scale monitoring, handles sensitive personal data as a core activity, or operates as a public entity with significant processing responsibilities.
00:39:05.760 --> 00:39:15.440
So the Society Data and AI Authority has published a couple of kind of guiding literatures here.
00:39:15.599 --> 00:39:41.280
So they said to determine if you fall under one of these categories, and consider things like the number of data subjects you handle, the actual volume of the personal data, what's the type of personal data, what's the geographical scope of your processing, and what are the categories of data subjects that you handle.
00:39:41.599 --> 00:39:50.559
So that's the kind of things to consider if you're asking do we carry out large-scale monitoring?
00:39:51.119 --> 00:39:58.400
Um it's kind of similar to the to the Indian law, then, is it?
00:39:58.480 --> 00:40:03.039
So it's it's only when there's high risk processing taking place.
00:40:03.840 --> 00:40:10.000
Yeah, basically, or a public entity with significant responsibility.
00:40:10.079 --> 00:40:14.880
So I suppose that could you could kind of use the same guidance there.
00:40:15.119 --> 00:40:20.079
Or if you if handling sensitive personal data is a core activity.
00:40:20.320 --> 00:40:29.119
So again, financial institutions and healthcare and hospitals and so on, yeah.
00:40:29.679 --> 00:40:30.079
Yeah.
00:40:30.960 --> 00:40:44.400
Um so they need to document their equipment of a DPO, and whether they're an internal employee or external, um, they don't need to be internal.
00:40:44.880 --> 00:41:01.360
And so the DPO's responsibilities, very much like the GDPR, monitoring compliance, advising on obligations, training staff, uh point of contact for the for the SDAIA.
00:41:02.320 --> 00:41:09.840
Um there is guidance out there of like what kind of qualifications a DPO should have.
00:41:09.920 --> 00:41:13.039
So there's a few considerations they put out there.
00:41:13.199 --> 00:41:28.000
Um they need to have the appropriate academic qualifications and experience, they need to have a knowledge of risk management practices, knowledge of the regulatory requirements and so knowledge of the law.
00:41:28.559 --> 00:41:38.559
Um interestingly, they need to be um an honest, they need to be a person that demonstrates honesty and integrity.
00:41:39.119 --> 00:41:46.800
So they also can't have been convicted of any offence involving dishonesty or a breach of trust.
00:41:47.119 --> 00:41:52.960
So um those two considerations seem to be kind of independent of each other.
00:41:53.199 --> 00:42:00.880
So the honesty and integrity, and then not been convicted of any offence involving dishonesty or a breach of trust.
00:42:01.119 --> 00:42:16.800
So that's to me, that's a nice addition, but I'd just love to know what way they're going to consider whether someone is honest and you know, the integrity and honesty of person are just being interact, you know.
00:42:17.360 --> 00:42:20.320
Maybe it's a background check or something they may have to do.
00:42:21.360 --> 00:42:22.079
Yeah, true.
00:42:22.239 --> 00:42:32.960
I'd that's just my personal I'd you know, I just like to know the the kind of thought patterns of whoever's appointing them, of what they are gonna be, you know, is there gonna be criteria?
00:42:33.119 --> 00:42:35.920
Is there gonna be like a code of practice?
00:42:36.800 --> 00:42:51.599
Maybe there's more out there than but yeah, so they're conceptually similar, but it is it is a bit more like the Indian DPDP than the GDPR when it comes to the appointment of a DPO.
00:42:52.400 --> 00:43:05.119
I think that's an interesting consideration as well, that they you know, they look for a trustworthy individual, they may check their background to see if they have any kind of criminal record or kind of any kind of wrongdoing.
00:43:05.360 --> 00:43:10.880
It kind of reflects the importance that they put on data and personal data, you know.
00:43:11.360 --> 00:43:12.960
Yeah, yeah, yeah.
00:43:13.199 --> 00:43:13.679
Yeah.
00:43:13.920 --> 00:43:17.840
So, like like somebody in Europe said, data is a new oil.
00:43:17.920 --> 00:43:25.599
So I suppose, especially for Saudi Arabia, important to protect personal data, like oil.
00:43:26.559 --> 00:43:49.519
Yeah, I think it's another to me, it's another example of how they keep kind of considering personal data in more of a community-based understanding rather than individualistic because it keeps coming back, you know, thinking about not just the effect on the individual, but you know, kind of the broader effects on larger groups of people.
00:43:49.920 --> 00:43:58.960
You know, absolutely, and the country itself, you know, and the state, it's very kind of emphasized in the law, I would say.
00:44:00.079 --> 00:44:00.559
Yeah.
00:44:01.280 --> 00:44:03.199
Nice to note those differences.
00:44:11.360 --> 00:44:14.559
We'll move on to the next question here for you.
00:44:14.800 --> 00:44:20.239
Maria, what counts as personal as a personal data breach?
00:44:20.400 --> 00:44:24.960
So what what is a personal data breach and what do organizations need to do?
00:44:25.519 --> 00:44:26.639
Okay, thanks, Kaylee.
00:44:26.719 --> 00:44:38.559
So I think it's this is really an interesting area as well because a personal data breach under the PDPL is defined very broadly, not just about a hackers trying to hack into the organization.
00:44:39.039 --> 00:44:51.199
It includes any kind of incident or accidental or intentional breach of personal data as well that leads to loss or alteration or disclosure or unauthorized access to personal data.
00:44:51.360 --> 00:45:03.679
So it could actually be also internal, like if somebody internally, like a nosy person checking somebody's health record, you know, or something like that, that would be seen as a breach as well.
00:45:03.840 --> 00:45:30.159
So a cyber attack counts, of course, but so do everyday mistakes like emailing data to the wrong person within the organization, losing a laptop, misconfiguring a cloud service where data is personal data is is breached, or exposing within the environment within the cloud environment as well, or exposing information through poor access controls to employees that shouldn't have access to that kind of personal data.
00:45:30.320 --> 00:45:31.920
So that's really interesting, you know.
00:45:32.079 --> 00:45:44.000
And again, I think that, like you say, it might go back to the kind of community or cultural thing about exposing personal data to people within the community that shouldn't have access to that data.
00:45:44.159 --> 00:46:00.079
You know, like like you say, it's kind of private, not just out for protecting people from outside the country, but it's also it seems to be to protect people from even people from in the the culture or from in within the community, you know.
00:46:00.639 --> 00:46:02.480
So there seems to be a trend there.
00:46:02.639 --> 00:46:06.480
So the PDPL focuses on the likelihood of harm.
00:46:06.719 --> 00:46:20.320
If the incident could affect someone's privacy, their dignity, which is important and interesting, financial security or their you know their their human rights, the organization must treat it as a breach and take action.
00:46:20.559 --> 00:46:23.840
This reflects Saudi Arabia's emphasis on trust.
00:46:24.000 --> 00:46:29.280
Again, we're that's coming up again, strong governance around national data assets.
00:46:29.440 --> 00:46:41.280
So when a breach occurs, the organization must notify the Saudi authority or the SDAIA and the regulator as soon as it becomes as soon as the organization becomes aware of the breach.
00:46:41.599 --> 00:46:54.079
There's no fixed kind of 72-hour rule like we have in the GDPR, but the expectation is you know, make sure it's prompt reporting, especially when sensitive or high-risk data is involved.
00:46:54.239 --> 00:47:07.440
If the breach is likely to cause harm to the individuals, the organization must also notify the individuals of the breach and explain what happened, what data was exposed, and what steps they should take to protect themselves.
00:47:07.519 --> 00:47:24.320
So again, you have you have a similar kind of procedure as the GDPR, but kind of more of an emphasis on protecting the individual from not just external threats but also within the community or within even within their workplace, you know.
00:47:24.559 --> 00:47:38.159
So the PDPL also requires immediate remedial action, similar to the GDPR, containing the breach, preventing further exposure, restoring data if possible, and reviewing internal safeguards to avoid repeat incidences.
00:47:38.239 --> 00:47:41.519
So again, the breach procedure is very similar to the GDPR.
00:47:41.840 --> 00:47:52.639
Organizations also document the response because the Saudi authority should, or you know, the regulator may request evidence of how the incident was handled.
00:47:52.800 --> 00:47:56.239
So compared to the GDPR, the overall structure is very similar.
00:47:56.480 --> 00:48:04.960
Both require reporting, transparency, and mitigation, but again, the PDPL places emphasis on central oversight.
00:48:05.199 --> 00:48:17.440
Uh, the the supervisory authority or the SDAIA has stronger authority to intervene and impose controls or restrict processing in higher risk situations.
00:48:17.679 --> 00:48:30.079
You know, breaches include any incident that compromises personal data, and organizations must report it or notify individuals if harm is possible, similar to the GDPR.
00:48:31.119 --> 00:48:35.679
So, Katie, this brings us to our last question, which is for you.
00:48:36.000 --> 00:48:44.239
And the question is: what are the penalties for non-compliance and how does the PDPL enforce non-compliance?
00:48:45.760 --> 00:49:00.000
So it does come with quite substantial administrative fines, up to 5 million Saudi Riel, with the potential for doubled penalties if an organization commits repeat violations.
00:49:00.880 --> 00:49:04.719
So quite a good deterrent there.
00:49:05.039 --> 00:49:17.360
But they also have a couple of criminal penalties of imprisonment fines for unlawful disclosure of sensitive data or illegal across border data transfers.
00:49:18.159 --> 00:49:20.880
So quite a bit more severe there.
00:49:22.719 --> 00:49:38.800
The enforcer of these penalties is the FDAIA, and the regulators have shown willingness to enforce, especially in situations of national security and public trust.
00:49:39.119 --> 00:49:44.000
So that's an almost you know, national security public trust.
00:49:44.079 --> 00:49:48.000
That's in about every second question nearly that we went through.
00:49:48.159 --> 00:49:50.000
So it's very important to them.
00:49:51.840 --> 00:49:58.559
And it's also evidenced by the fact that they are willing to put people in prison if they breach if they breach the law.
00:50:00.159 --> 00:50:11.039
Um especially for the cross-border illegal cross-border transfers that they can into with criminal penalties.
00:50:11.519 --> 00:50:16.639
Um so it it is quite different to the GDPR in that sense.
00:50:16.960 --> 00:50:22.880
Actually, um GDPR relies mainly on administrative fines.
00:50:24.000 --> 00:50:24.800
That's it.
00:50:25.039 --> 00:50:27.599
I mean criminal liability.
00:50:34.159 --> 00:50:35.440
No, absolutely.
00:50:35.760 --> 00:50:48.239
And I think probably yeah, and that I think that probably falls on the leaders, like the you know, I would say that would probably be the CEO or managing directors or the board or so on, um of organizations.
00:50:50.000 --> 00:50:50.960
Yeah, hopefully not.
00:50:51.519 --> 00:50:58.400
I wonder, does the DPO have that independence like it does under the GDPR?
00:50:59.599 --> 00:51:02.400
That might be an interesting question to ask.
00:51:19.199 --> 00:51:29.280
So the DPO under the Saudi PDPL does not have the same level of statutory independence as the GDPR PR DPO.
00:51:30.000 --> 00:51:30.159
Okay.
00:51:31.199 --> 00:51:32.559
It's not in the same way.
00:51:32.719 --> 00:51:37.280
Under the GDPR, the data protection officer is a legally protected role.
00:51:37.440 --> 00:51:41.440
They must act independently and cannot cannot be dismissed, as we know.
00:51:41.599 --> 00:51:48.400
Um, but under the Saudi PDPL, the level of independence isn't explicitly built into the law.
00:51:48.559 --> 00:52:04.079
So the PDPL does allow organizations to appoint someone responsible for privacy oversight, but it doesn't include the GDPR style protections around independence, job security, and guaranteed access to leadership.
00:52:04.800 --> 00:52:08.320
Instead, the PDPL takes a governance-driven approach.
00:52:08.480 --> 00:52:23.519
The person overseeing data protection must ensure compliance with the law, support internal controls, manage breach notifications, and coordinate with the uh the Saudi regulator, but they operate within the organization's normal management structure.
00:52:24.719 --> 00:52:33.280
So the version of a DPO under the D the PDPL is more of a compliance coordination role rather than an independent statutory officer.
00:52:34.159 --> 00:52:35.280
That's interesting.
00:52:36.159 --> 00:52:37.119
That is, yeah.
00:52:37.840 --> 00:52:46.639
And that has that could have different implications for the DPO and how they conduct themselves in the organization, you know?
00:52:47.519 --> 00:52:55.280
Yeah, that kind of honest integrity consideration is quite important in light of that.
00:52:56.000 --> 00:53:12.880
Conflict of interest could be um an issue for DPOs taking taking up the role of a DPO in in the Kingdom Saudi Arabia, Kingdom of Saudi Arabia, because if they don't have that protection they won't feel as competent to call out wrongdoing, you know.
00:53:14.000 --> 00:53:14.559
Yeah.
00:53:15.360 --> 00:53:19.599
So the the integrity of the individual is very important then in that respect.
00:53:20.320 --> 00:53:20.719
Great.
00:53:20.800 --> 00:53:22.239
So thanks, Katie, for that.
00:53:22.400 --> 00:53:25.760
That was a really interesting uh final question.
00:53:26.400 --> 00:53:30.880
So that brings us to the end of our walkthrough of the Saudi PDPL.
00:53:31.039 --> 00:53:40.320
Hopefully, this discussion gives you a clear understanding of how the law works, where it aligns with the GDPR, and where the key differences lie.
00:53:40.880 --> 00:53:43.840
Thank you, Katie, for joining me again today.
00:53:44.000 --> 00:53:46.719
And thank you to our listeners for tuning in.
00:53:46.800 --> 00:53:58.400
Um, don't forget to subscribe, and we'll see you in the next episode as we continue to explore our global privacy data protection and AI governance podcast.
00:53:58.880 --> 00:53:59.760
Thanks, Maria.
00:54:00.480 --> 00:54:01.280
Thanks, everyone.
00:54:01.360 --> 00:54:02.159
Thanks, Katie.
00:54:02.480 --> 00:54:19.599
Take care of the
00:00:13.919 --> 00:00:16.160
Welcome everyone to today's episode.
00:00:16.320 --> 00:00:22.320
It's the second episode in Privacy Engine series on international data protection legislation.
00:00:22.640 --> 00:00:32.320
We started off last week with the India Indian Data Protection Law, or what we call the Digital Personal Data Protection Act of 2023.
00:00:32.719 --> 00:00:40.240
And today we're looking at the Kingdom of Saudi Arabia's Personal Data Protection Law, or what we call the PDPL.
00:00:40.880 --> 00:00:53.039
We'll break down the law in terms of what it does, how it compares to the GDPR, and what organizations need to do if they are preparing to be compliant with the law.
00:00:53.359 --> 00:00:59.439
I'm joined, like I was last week, by my friend or my and colleague Katie.
00:01:00.079 --> 00:01:03.600
And like last week as well, we'll take we'll alternate the questions.
00:01:03.759 --> 00:01:08.159
So I'll start with the first question and then Katie will go on with the second question and so on.
00:01:08.319 --> 00:01:12.400
We have about 12 questions, like we did last week as well.
00:01:13.359 --> 00:01:25.680
So hopefully this podcast will take you on a journey where you'll get a clear, engaging tour of one of the most important data protection laws in the Gulf region.
00:01:47.200 --> 00:01:54.079
It sets out how personal data must be collected, used, stored, shared, and transferred.
00:01:54.239 --> 00:02:06.879
And it gives individuals really clear rights that are very similar to the GDPR as well, and places obligations, very formal obligations on organizations in terms of uh processing personal data.
00:02:07.040 --> 00:02:12.800
And it's similar to other global uh privacy laws like the GDPR.
00:02:12.960 --> 00:02:21.520
It was introduced as part of Saudi Arabia's Vision 2030 digital transformation, and that's that's we can talk about that later on.
00:02:21.759 --> 00:02:24.560
I have information here about it actually.
00:02:24.800 --> 00:02:34.479
But the Saudi Saudi Arabia's um Vision 2030 is essentially the kingdom's blueprint for economic and social transformation.
00:02:34.719 --> 00:02:38.479
Um and the digital innovation sits right at the center of this.
00:02:38.719 --> 00:02:47.680
So the idea is to shift the country away from purely oil-independent economy and build a modern, diverse, technology-driven society.
00:02:47.919 --> 00:02:59.599
Okay, so the country is rapidly expanding cloud services, AI, fintech, a digital government, and it has a massive smart cities project which is called NEOM.
00:02:59.759 --> 00:03:05.280
And NEOM is like Saudi Arabia's flagship future city project.
00:03:05.520 --> 00:03:10.879
It's huge and it's in the northwest of the country near the Red Sea.
00:03:11.039 --> 00:03:24.479
It was created as part of the Vision 2030, and it's not just a city, it's more of a cluster of developments that are meant to showcase the ultra-high-tech low-carbon urban living and what that could look like.
00:03:25.120 --> 00:03:31.680
So the total of the NEOM area is 26,500 square kilometres.
00:03:31.840 --> 00:03:34.479
So it's not like a city, it's more like a small country.
00:03:34.639 --> 00:03:36.000
So that's really exciting.
00:03:36.240 --> 00:03:43.360
So, you know, the the PDPL is a crucial part of that development for Saudi Arabia.
00:03:44.159 --> 00:03:48.479
So the law also attracts um helps to attract international investment.
00:03:48.560 --> 00:03:59.360
And before the PDPL, there was no unified data protection regime, which made global companies hesitant to process to come to the kingdom.
00:03:59.520 --> 00:04:08.960
The law, especially after its 2023 amendments, aligns more closely with international standards and creates a workable system for cross-border transfers.
00:04:09.120 --> 00:04:24.240
The PDPL also reinforces national data sovereignty, central oversight by the Saudi data and AI authority, reflecting Saudi's priorities around security, cultural norms, and responsible innovation.
00:04:24.399 --> 00:04:34.399
At the same time, it responds to growing public expectations by giving people their rights to their data, the right to access, the right to correct, the right to delete.
00:04:34.480 --> 00:04:37.600
And we look at those in more detail as we go through the podcast.
00:04:37.839 --> 00:04:50.319
And finally, the PDPL lays the groundwork for safe AI and data analytics, ensuring these technologies are developed within trusted, well, well-governed legal environment.
00:04:50.480 --> 00:04:59.199
And in short, it's not just a privacy law, it's a strategic foundation for Saudi Arabia's modern digital AI-driven future.
00:04:59.519 --> 00:05:02.879
Okay, so moving on to the next question then.
00:05:03.360 --> 00:05:05.360
Katie, this question is for you.
00:05:06.000 --> 00:05:12.240
Who does the PDPL apply to, both inside and outside of Saudi Arabia?
00:05:14.079 --> 00:05:17.120
So the Act does have quite a broad scope.
00:05:17.360 --> 00:05:32.480
It applies to any organization that processes personal data of individuals who are located inside the kingdom, whether the organization is physically in the kingdom or operating from abroad.
00:05:32.800 --> 00:05:35.600
They include public and private sectors.
00:05:35.920 --> 00:05:45.759
And again, something interesting we had from our previous talk about the Indian law, it does extend to deceased persons as well.
00:05:46.079 --> 00:05:53.519
But in this case, only to the extent that it could identify the individual or their family members.
00:05:53.839 --> 00:06:02.480
So that's kind of quite an interesting common thread in this law, actually, that reflects the local culture of that area.
00:06:02.720 --> 00:06:08.480
That kind of they have quite strong family identities and reputations there.
00:06:08.639 --> 00:06:13.439
So it's just interesting that that comes in through the data protection law.
00:06:13.680 --> 00:06:23.920
And so other than that small detail there, that it is basically identical to the to the territorial scope of GDPR.
00:06:24.240 --> 00:06:30.879
If you target or monitor people in Saudi Arabia, you have to abide by this law basically.
00:06:31.199 --> 00:06:35.040
Again, the GDPR only really applies to living individuals.
00:06:35.279 --> 00:06:40.079
So I'd say that's the that's the main thing in the material scope to look out for.
00:06:40.959 --> 00:06:41.839
Yeah, exactly.
00:06:41.920 --> 00:07:00.560
And we've seen that now, like you say, with the Indian law and now with the Saudi Arabian law, that it it considers deceased individuals as well in various different ways, but that was that's something that the GDPR has never never considered, you know, and even in the digital omnibus, it's not even thought about there.
00:07:00.879 --> 00:07:02.560
So that's interesting.
00:07:03.360 --> 00:07:06.959
It is I think that it reflects kind of culture, I think maybe.
00:07:07.920 --> 00:07:09.439
Yeah, yeah, I agree.
00:07:09.680 --> 00:07:24.560
I quite like that it extends to the extent that it could identify someone as well here, that it's kind of making that distinction, like it's kind of helping explain why we should maybe think about diseased persons' data.
00:07:25.199 --> 00:07:25.839
I agree.
00:07:26.079 --> 00:07:26.399
Yeah.
00:07:26.720 --> 00:07:30.160
And like you say, there's implications for the family, you know.
00:07:30.480 --> 00:07:30.720
Yeah.
00:07:31.759 --> 00:07:32.639
Oh, definitely.
00:07:32.959 --> 00:07:33.279
Yeah.
00:07:33.519 --> 00:07:41.120
Um so Maria, how does it actually define personal data?
00:07:41.439 --> 00:07:45.199
Does it have a special category data equivalent?
00:07:46.240 --> 00:08:00.879
Yeah, actually, so like the Indian Act last week, we saw that you know special category data doesn't exist in the Indian Act, but um here in the PDPL, there is a, you know, they do make that distinction.
00:08:01.120 --> 00:08:05.600
So the PDPL defines personal data in a very broad way.
00:08:05.759 --> 00:08:24.639
It includes any information that identifies a person directly or indirectly, um, not just names and ID numbers, but also behavioral data and device identifiers and employee employment details and location information can even be deemed as personal data.
00:08:24.879 --> 00:08:49.759
So any kind of information that can be linked back to the individual can be seen as personal data, which is interesting again because when you consider the digital omnibus, now they're looking to change the per the definition of personal data in the GDPR because they're they're now saying that certain pseudonyms certain pseudonymized data under the GDPR may not be covered by the GDPR.
00:08:49.919 --> 00:08:51.440
So that's that's interesting.
00:08:51.600 --> 00:08:54.159
So there's kind of like an opposite happening.
00:08:54.320 --> 00:09:03.039
Like, you know, the the PDPL is very broad in scope, and whereas the GDPR seems to be reducing it somewhat, you know.
00:09:03.360 --> 00:09:09.440
The law then goes further by creating a category of sensitive personal data which receives stronger protections.
00:09:09.600 --> 00:09:11.200
So again, like the GDPR.
00:09:11.279 --> 00:09:18.399
This includes health information, but it also includes financial data, which is not covered under the GDPR, special category data.
00:09:18.559 --> 00:09:27.120
It also includes genetic data, religious or philosophical beliefs, again like the GDPR, ethnic origin and security-related identifiers.
00:09:27.200 --> 00:09:29.279
So it's slightly different there from the GDPR.
00:09:29.519 --> 00:09:35.679
These categories are treated as high risk because misuse could cause harm or discrimination.
00:09:36.000 --> 00:09:41.200
They also reflect cultural and national considerations specific to Saudi Arabia.
00:09:41.440 --> 00:09:53.519
Like, for instance, biometric data like fingerprints and facial recognition, it's given stricter treatment with Saudi Arabia moving quickly into AI and digital identity and smart cities initiatives and so on.
00:09:53.679 --> 00:10:06.639
The PDPL requires organizations to apply very strong safeguards, obtain explicit consent in some cases, and conduct risk assessments before using biometric or genetic data, which is which is a good sign.
00:10:06.879 --> 00:10:14.799
Compared to the GPR, both GDPR, both laws treat sensitive and biometric data as requiring extra protection.
00:10:14.879 --> 00:10:31.200
So that's similar to the GDPR, but the PDPL does within a more centralized governance model focused on data sovereignty and national security, as opposed to you know what the GDPR would do, it's more like rights focused.
00:10:32.080 --> 00:10:38.480
So you could say, in this respect, the PDPL is more controlled or prescriptive.
00:10:39.360 --> 00:10:57.919
So, in short, the PDPL uses a broad definition of personal data, it treats sensitive and biometric categories as high risk and requires stricter safeguards when processing them, all reflecting the kingdom's priorities around trust and governance and um safe digital transformation.
00:10:58.399 --> 00:11:00.320
So Katie.
00:11:01.279 --> 00:11:01.919
Yeah.
00:11:02.879 --> 00:11:18.799
I was just gonna say I also when I was looking through it, I noticed one element of the sensitive category data was also data that indicated one or both of a data subject's parents are unknown.
00:11:19.200 --> 00:11:38.080
So I just thought that was another interesting reflection of kind of the cultural revel relevance of family backgrounds in the area, which again, like in the deceased individuals we've seen, reference to the family connections and then under the sensitive category data.
00:11:38.480 --> 00:11:48.480
I just you know they're kind of thinking about individuals in a wider context than individual which than the GDPR etc.
00:11:49.279 --> 00:11:58.639
Which and when you say when one of the parents is unknown, does is that does that then become a special category data or sensitive data?
00:11:59.519 --> 00:12:01.440
Or or how does that work?
00:12:02.399 --> 00:12:18.639
Well it said for the data that indicates one or both of the individuals' parents are one are unknown, was included in the article that defines sensitive category data.
00:12:18.799 --> 00:12:35.279
So I just think it's it's almost more community-based, like I don't know, then the European understanding of personal data, it kind of considers the impact community impact as rather than just the impact on the individual as well.
00:12:35.679 --> 00:12:36.399
Yeah, okay.
00:12:36.559 --> 00:12:48.080
So if an individual if if one of the parents is unknown, then that m may be sensitive within her environment or her community, so his community.
00:12:48.240 --> 00:12:58.960
So keeping that private would probably, yeah, probably um help them, you know, uh feel more comfortable in their in their uh in their community, maybe.
00:12:59.360 --> 00:12:59.519
Yeah.
00:12:59.919 --> 00:13:00.720
Yeah, yeah.
00:13:00.960 --> 00:13:04.720
That's what I was inter interested in another.
00:13:05.679 --> 00:13:08.639
Yeah, something different to the European perspectives, yeah.
00:13:08.720 --> 00:13:21.600
And so probably something that's important for their culture, that that obviously wasn't important enough for for it to be included in the GDPR, but yeah, that's interesting, uh an interesting distinction.
00:13:24.320 --> 00:13:32.559
Okay, so Katie, uh the next question for you is what are the main lawful bases for processing personal data under the PDPL?
00:13:32.720 --> 00:13:43.039
So last week again we saw the Indian uh the Indian uh Act or the PDPD of 2023 being quite different to the GDPR.
00:13:43.120 --> 00:13:52.799
So is the KSA similar to to uh the or the PDPL similar to the Indian law or is it more similar to the GDPR?
00:13:55.120 --> 00:13:58.240
Well, I'd I'd say it's a bit of both and neither.
00:13:58.399 --> 00:13:59.039
I don't know.
00:13:59.360 --> 00:14:06.879
So the PDPL is consent first, basically, which is flipped from the GDPR.
00:14:06.960 --> 00:14:23.440
I mean, I feel like it's actually the supervisory parties in Europe right now are kind of discouraging people from relying on consent as much because of you know the consideration for the fact that consent may not be freely given in a lot of cases.
00:14:23.759 --> 00:14:32.559
So consent is the is the main basis for processing personal data under the PDPL.
00:14:33.120 --> 00:14:38.960
Um but Article 5 does say it needs to be explicit, informed, and freely given.
00:14:39.200 --> 00:14:44.159
It does say that the data subject can withdraw the consent at any time.
00:14:45.039 --> 00:15:00.240
So I mean, I wouldn't really be consent if I suppose if you couldn't, but Article 6 then goes on to allow a couple of different situations where you do not need the consent of the data subject.
00:15:00.480 --> 00:15:36.000
Um they have the the vital interest basis, they have the actual interest of the data subject, they have legal obligations, contractual agreement, um for matters of security, uh judicial requirements, and they do have for the legitimate interest of the controller, but only where those interests do not harm individuals' rights or contradict the law's purpose.
00:15:36.799 --> 00:15:46.159
So they do have the concept of legitimate interest, but it is a bit narrower than the GDPR version now.
00:15:46.320 --> 00:15:58.639
It's only legal where there's no sensitive data as well, so they can't kind of mix legitimate interest for protest and sensitive data, and they do need to complete an assessment.
00:15:58.879 --> 00:16:09.679
So I mean, back to back, the GDPR encourages uh kind of taking a case-by-case basis when it comes to legal basis.
00:16:10.080 --> 00:16:14.559
They kind of don't want people to be relying on consent in every situation.
00:16:15.440 --> 00:16:25.679
Um the PDPL is basically backwards and saying, you know, consent first, and if you can't get it, then you need to fit into one of these other categories.
00:16:26.399 --> 00:16:38.799
So and I think it's interesting as well to say that you know, again, with the digital army bus coming down the line, legitimate interest is going to be widened under the GDPR and the EU AI Act.
00:16:38.960 --> 00:16:43.600
So I it would be really interesting to know, and I don't know this answer, but maybe we can look look into it.
00:16:43.759 --> 00:16:54.320
But it would be really interesting to know how uh Saudi Arabia or even India uh justifies the use, you know, processing of personal data in AI systems.
00:16:54.559 --> 00:17:15.519
Because under the GDPR now, um uh we we're seeing that they're saying that you know you could actually use legitimate interest for processing personal data in your AI systems, which in my opinion could cause a conflict of interest for the G DPO quite easily, you know, but that's another discussion.
00:17:15.759 --> 00:17:17.200
But yeah, it's it's interesting.
00:17:18.400 --> 00:17:20.160
Yeah, yeah.
00:17:21.519 --> 00:17:31.759
So so yeah, so the the in the in the PDPL legitimate interest does exist, but it's not as wide as the GDPR.
00:17:32.160 --> 00:17:32.720
That's interesting.
00:17:32.880 --> 00:17:38.160
Yeah, and you can't use uh sensitive uh data.
00:17:43.839 --> 00:17:46.240
We'll move on to the next question.
00:17:46.480 --> 00:17:51.759
Um so Maria, what rights do people have under the PDPL?
00:17:52.720 --> 00:17:53.440
Thanks, Katie.
00:17:53.599 --> 00:17:59.920
Well, I think again, so these are quite similar, in my opinion, to the GDPR.
00:18:00.319 --> 00:18:02.880
There, from what I can understand, there are six rights.
00:18:03.119 --> 00:18:11.359
So one of the key features of the Saudi PDPL is that it gives individuals a set, a clear set of data subject rights.
00:18:11.519 --> 00:18:23.839
Um, these rights are central to building trust in the digital services and supporting the kingdom's shift towards a modern accountable data ecosystem, like we were saying earlier on.
00:18:24.079 --> 00:18:36.880
So people have the right to be informed, which means organizations must clearly explain what data they're collecting, why they're collecting it, and how it will be used, and who it may be shared with.
00:18:36.960 --> 00:18:39.519
So that again, similar to the GDPR here.
00:18:39.680 --> 00:18:45.759
Privacy notices need to be transparent and accessible and not buried within legal jargon.
00:18:46.000 --> 00:18:49.519
Individuals also have the right to access their data.
00:18:49.759 --> 00:18:53.119
They can request a copy of the information an organization holds about them.
00:18:53.200 --> 00:19:04.720
So that again is like a data subject access request, which is especially important now that the that more services rely on cloud platforms and AI systems within the kingdom.
00:19:04.960 --> 00:19:18.480
They also have the so individuals also have the right to correct inaccurate or outdated data, which is crucial in in sectors like financial and healthcare, because you know you can have serious consequences in those two industries.
00:19:18.720 --> 00:19:24.799
The PDPL also recognizes a right to request deletion, but this is within limits.
00:19:24.880 --> 00:19:36.000
So people can ask for their data to be erased when it's no longer needed, but in certain situations, organizations may need to keep some information for legal or security reasons.
00:19:36.079 --> 00:19:38.880
So, again, that's very similar to GDPR there.
00:19:39.920 --> 00:19:52.160
Another significant protection is the right to restrict processing, something that we didn't see in the Indian Act of last week, but what it also exists in the GDPR.
00:19:52.480 --> 00:20:05.039
If someone believes that their data is being used unfairly or incorrectly, or if there's a legal process going on, then they can request the organization to pause processing until the issue has been resolved.
00:20:05.519 --> 00:20:16.799
There's also a growing expectation that individuals can challenge automated decision making, even though I don't think this is a right yet, but there is increased pressure in looking into this area.
00:20:17.039 --> 00:20:28.319
The PDP, the PDPL doesn't mirror the GDPR's article 22, but it does require transparency around profiling and automated decision making.
00:21:18.480 --> 00:21:31.359
In short, the PDPL gives individuals the right to be informed, to access their data, to correct it and to delete it under certain certain conditions, to restrict processing and to question automated decisions.
00:21:32.400 --> 00:21:41.519
And this is all aimed at increasing transparency, accountability, and public trust in Saudi Arabia's fast growing digital landscape.
00:21:43.359 --> 00:21:46.640
So next question now is for you, Katie.
00:21:47.039 --> 00:21:53.039
What obligations are organizations required to comply with under the PDPL?
00:21:54.880 --> 00:21:57.039
Um thanks for that, Maria.
00:21:57.279 --> 00:22:02.160
So they have A couple of different things to look out for.
00:22:02.319 --> 00:22:08.480
Um under Article eight, they need to do their due diligence with their processors.
00:22:08.799 --> 00:22:16.240
They need to basically make sure that their processors have an adequate level of compliance in relation to the law.
00:22:16.400 --> 00:22:20.400
So that's a responsibility on them, much like the GDPR.
00:22:20.480 --> 00:22:32.799
You know, you can't really claim ignorance as to what your subprocessors, how your subprocessors subprocessors are handling the data that you give to them.
00:22:33.119 --> 00:22:41.759
Um they need to implement uh accountability measures, ensure accurate and minimal data collection.
00:22:41.920 --> 00:22:46.880
They need to have technical and organizational security controls.
00:22:48.480 --> 00:23:14.160
They do need to maintain processing records, which not every international law imposes, and which even the GDPR is considering taking out for certain organizations, which I mean I think that maintaining processing records is kind of essential to every other thing that you do in relation to your compliance.
00:23:15.839 --> 00:23:20.720
I mean, it just it just takes more work off you at the at the end of the day.
00:23:20.799 --> 00:23:23.200
I mean it's easier.
00:23:23.519 --> 00:23:25.920
So yeah, they do have to do that.
00:23:26.160 --> 00:23:35.920
Um they have an obligation to uh train their employees, offer clear rights handling mechanisms for the data subjects.
00:23:36.160 --> 00:23:57.200
Um they do have impact assessments similar to DPIAs for high risk processing, new technologies, profiling or profiling, handling sensitive data, um, and then bridge notification obligations, which we'll kind of talk about further on, I think, in in a bit more detail there.
00:23:57.599 --> 00:24:04.240
So it's I mean it's quite identical to the GDPR there.
00:24:04.400 --> 00:24:17.119
Um the SETI enforcement does have a stronger emphasis on uh regulatory engagement, culturally specific expectations, like their notices have to be in Arabic.
00:24:18.079 --> 00:24:28.079
Um which I mean that's not so different when you consider that the GDPR notices have to be kind of intelligible.
00:24:28.559 --> 00:24:44.160
Um when you consider, I mean, the people who are who are going to be exercising their rights, you know, they need so I'd say yeah, it is it is it's almost one for one compared to the GDPR.
00:24:44.640 --> 00:24:54.640
You know how we saw last week as well with the Indian law that the data principal had certain obligations not to you know not to be vacatious and so on.
00:24:54.880 --> 00:25:05.279
Did do you have any idea whether that exists in the Saudi law, or is it very much like the GDPR in that it it doesn't seem to put any obligations on the data subject?
00:25:05.680 --> 00:25:07.359
Yeah, no, I don't I don't think they do.
00:25:07.440 --> 00:25:16.400
I think as far as those three laws, the Indian law is unique in imposing the obligation on the data subject, which I actually like that.
00:25:16.720 --> 00:25:17.200
I agree.
00:25:17.519 --> 00:25:18.640
That obligation.
00:25:19.200 --> 00:25:20.319
Yeah, um yeah.
00:25:20.640 --> 00:25:26.960
So Maria, what does the law say about international data transfers?
00:25:28.319 --> 00:25:34.319
So I think it again, so we look we saw in the Indian law last week, completely different to the GDPR.
00:25:34.559 --> 00:25:42.880
The Saudi, the PDPL, in my opinion, is much more like the GDPR in terms of the fact that it has adequacy requirements.
00:25:43.200 --> 00:25:51.839
So international data transfers are one of the areas where the Saudi PDPL has changed most, especially after the 2023 amendments.
00:25:52.079 --> 00:25:54.720
The original version of the law was very restrictive.
00:25:54.799 --> 00:25:59.839
It basically made it difficult for organizations to send personal data outside of Saudi Arabia.
00:26:00.000 --> 00:26:07.359
So but after 2023, they kind of made it more, they kind of made the act more or the PDPL more modern.
00:26:07.839 --> 00:26:19.599
Because before 2023 it caused issues for cloud services, multinational uh organizations, and and basically any kind of cross-border business uh business models.
00:26:20.000 --> 00:26:26.240
So the amended PDPL from 2023 is much more practical and aligned with global standards.
00:26:26.480 --> 00:26:34.079
Today, data can be transferred outside the kingdom, but only if proper safeguards are in place, and that's again similar to the GDPR.
00:26:34.240 --> 00:26:46.240
The core idea is simple: any personal data leaving Saudi Arabia must be protected to a level that isn't materially lower than what the PDPL guarantees inside the country.
00:26:46.400 --> 00:26:53.440
So, again, you can see that as kind of an adequacy agreement that you would have to put in place or you'd have to have with the GDPR.
00:26:53.839 --> 00:26:57.119
Or again, you know, standard contractual clauses.
00:26:57.279 --> 00:27:09.599
If you don't have an adequacy agreement, you'd have to get the standard standard contractual clauses in place to make sure that the data has the same level of protection outside as opposed to inside the country.
00:27:10.000 --> 00:27:14.079
There are a few ways organizations can meet that threshold.
00:27:14.160 --> 00:27:32.000
Uh, they can transfer data to a country that the data uh the Saudi authority has deemed adequate, or they can use strong contractual safeguards, again, similar to the SCCs in in Europe, like the PDPL compliant transfer agreements and that they have.
00:27:32.240 --> 00:27:42.960
And for very specific situations, such as fulfilling a contract or protecting someone's vital interests, the law allows for limited exceptions, which again are similar to the GDPR.
00:27:43.279 --> 00:27:49.839
So, what's unique about the PDPL is that its emphasis on the national data sovereignty.
00:27:50.160 --> 00:27:57.359
Organizations must show that the transfer is genuinely necessary and that they've limited the amount of data leaving the kingdom.
00:27:57.599 --> 00:28:09.680
The Saudi authority also keeps central oversight and can approve, restrict, or block these transfers, especially when sensitive categories or national security concerns are involved.
00:28:09.839 --> 00:28:17.440
So while the GDPR and the PDPL allow for international transfers based on adequacy, their philosophies are slightly different.
00:28:17.599 --> 00:28:33.359
The GDPR is driven by protecting fundamental rights, as we know, across the borders, while the PDPL focuses on ensuring that the data leaving the kingdom doesn't undermine the national governance or cultural or security priorities of the country.
00:28:33.680 --> 00:28:40.480
So, yeah, so kind of fundamental philosophical differences there between the two jurisdictions.
00:28:40.880 --> 00:28:47.839
Um so, Katie, tell us about the requirements for consent and privacy notices under the PDPL.
00:28:50.079 --> 00:28:55.839
Um okay, so I mean, as I said earlier, consent needs to be explicit.
00:28:56.400 --> 00:29:01.039
You need to obtain the consent before collecting or processing the data.
00:29:01.279 --> 00:29:07.920
Um and individuals need to be able to withdraw their consent at any time without negative consequences.
00:29:08.720 --> 00:29:21.599
I suppose without negative consequences, that kind of considers that point that the European perspective of why consent may not be appropriate in all circumstances.
00:29:22.240 --> 00:29:29.039
Um but so it's Article 12 and 13 that talks about the privacy notices in particular.
00:29:29.200 --> 00:29:33.440
Uh they need to be clear, accessible, and usually in Arabic.
00:29:34.240 --> 00:29:39.920
Um they need to be provided to data subjects prior to the collection of their data.
00:29:40.079 --> 00:30:02.400
And it needs to it needs to outline the controller's identity, the purpose of processing, the legal basis they're relying on, how long the data is going to be retained for, what rights they can exercise, whether the data is going to be disclosed to a third party, how someone can object or withdraw the consent.
00:30:03.200 --> 00:30:16.960
Um it needs to inform them of their right for complaint, and it also needs to explain whether the data is mandatory and what could happen if the data subject declines to share that information.
00:30:17.200 --> 00:30:33.680
So, you know, I suppose everyone might want to exercise their rights to not share data, but I mean in some circumstances that might actually have an effect on your experience of a particular service, so it's an interesting addition.
00:30:33.839 --> 00:30:40.799
But yeah, overall the transparency transparency expectations are quite similar to the GDPR.
00:30:41.759 --> 00:30:50.240
Um again the language emphasis, but I mean it's their country, their language at the end of the day.
00:30:50.799 --> 00:30:52.240
Absolutely, yeah.
00:30:53.359 --> 00:31:25.279
And it also requires that it needs to be accessible to individuals with varying levels of digital literacy, which I quite like because I mean I know just personally, some people in my life have never no concept of you know what the repercussions could be of giving their consent to something or withdrawing their consent, you know, and I you can't blame them either because it's just not everyone's you know ballpark.
00:31:25.440 --> 00:31:39.920
So absolutely, I I agree, and that sounds to me like the protections that are in place in the financial industry where if you sell an individual a financial product, you have to be sure that they understand what they're buying, you know.
00:31:40.160 --> 00:31:44.400
So, again, that would be kind of financial literacy and understanding what you're getting into.
00:31:44.559 --> 00:31:51.599
I think it's very similar in the digital age, like giving consent, but they have to understand what are they giving consent to.
00:31:51.920 --> 00:32:02.799
Like you can you can you can give them a whole load of jargon and kind of befuddle them and confuse them, and and you know, that's not explicit consent, in my opinion, you know.
00:32:03.119 --> 00:32:04.000
So I agree.
00:32:04.559 --> 00:32:09.920
Digital literacy is is essential in terms of making sure you have explicit consent.
00:32:10.079 --> 00:32:11.119
So that's a good point.
00:32:13.200 --> 00:32:17.599
Yeah, um that's quite quite a good point.
00:32:17.920 --> 00:32:22.400
So I'll move on to the next question for you here, Maria.
00:32:22.559 --> 00:32:28.240
How does the law treat AI profiling and automated decision making?
00:32:29.119 --> 00:32:43.920
Okay, so this is an interesting question as well because again, we've seen, like we've discussed it already, that you know, they're looking at Vision 2030, they're looking at smart cities, they're really jumping into digital identity and AI systems and so on.
00:32:44.160 --> 00:32:51.039
So, but it doesn't actually have the equivalent of the EU AI Act that we have in Europe at the moment.
00:32:51.359 --> 00:33:08.319
Um and so it doesn't have a kind of the PDPL as well as a data protection law doesn't have a kind of standalone AI chapter, but it still places clear rules uh around how AI profiling and automated decision making can use personal data.
00:33:08.480 --> 00:33:19.440
So, again, similar like to the GDPR, it's not it doesn't specifically give definitions of AI, but it talks about profiling, it talks about automated decision making.
00:33:19.680 --> 00:33:36.640
So data Saudi Arabia views AI as a major part of its vision 2030, like we said, and the PDPL is designed to support innovation, is is designed to support innovation while also setting boundaries around higher risks, uh higher risk uses.
00:33:36.720 --> 00:33:54.400
So, again, we saw that kind of balance in the Indian law last week, and so I think what what the the PDPL tries to do as well is to try and get that balance right between you know being innovative but also protecting the state as well as their citizens.
00:33:54.559 --> 00:34:14.559
So, under the PDPL, any AI system that processes personal data must follow the law's core principles, having a lawful basis, limiting processing to a specific purpose, collecting only what's necessary, so that's data minimization under the GDPR, and ensuring fairness, transparency, and security.
00:34:14.719 --> 00:34:26.000
These rules apply whether we're talking about basic analytics or advanced machine learning models in fintech, healthcare, and smart cities environments, so it's across the board.
00:34:26.320 --> 00:34:33.199
Profiling and an automated decision making are treated as potentially high-risk activities, which in my opinion they are.
00:34:33.440 --> 00:34:41.360
When AI is used to make decisions about people, such as hiring, credit scoring, eligibility assessments.
00:34:41.440 --> 00:34:52.480
Like we have again, we have a lot coming from the European Court of Justice in this area where they're trying to understand what is what is seen as automated decision making and what's not.
00:34:52.960 --> 00:34:55.119
There's been a number of cases.
00:34:55.280 --> 00:34:59.360
Um Shufa was one of them back in December 2023.
00:34:59.440 --> 00:35:08.000
There was another one in February of 2024 about a decision making and what can we understand as automated decision making.
00:35:08.159 --> 00:35:12.320
So again, the the the similar kind of issues are coming up.
00:35:12.639 --> 00:35:26.159
So hiring, credit scoring, eligible eligibility assessments or behavioral predictions against around you know the EU AI Act would ban some of those behavioural prediction AI systems.
00:35:26.480 --> 00:35:38.000
Organizations need stronger risk assessments, enhanced safeguards, and some degree of explainability so individuals understand how those how those automated decisions were made.
00:35:38.239 --> 00:35:48.239
Individuals have the right to know when automated processing is happening, and so they need notification around, you know, it's a it's an AI system that's processing their data.
00:35:48.400 --> 00:35:54.559
And in some cases, the right to challenge or correct decisions made solely by algorithms exist.
00:35:54.880 --> 00:36:03.679
The PDPL doesn't have a direct equivalent of the GDPR's article 22, like we said before, but the expectation is similar.
00:36:04.000 --> 00:36:09.119
Important automated decisions should not be completely opaque or unchecked.
00:36:09.199 --> 00:36:13.920
So you have to have that human human in the loop again, like with the GDPR.
00:36:14.079 --> 00:36:17.199
So biometric data adds another layer of obligation.
00:36:17.440 --> 00:36:24.480
So if you have biometric data, you know, they they they look at it more, there's more kind of obligations around that.
00:36:24.719 --> 00:36:33.760
If AI uses facial recognition or voice prints or other kind of biometric identifiers, the PDPL classifies this as especially high risk.
00:36:34.079 --> 00:36:47.519
That means stricter security controls, access rules, retention limits, and in many cases explicit consent, reflecting both national security.
00:36:47.679 --> 00:36:54.880
Again, the national security kind of comes up as well as the fundamental or the you know the human rights um and cultural sensitivity.
00:36:55.039 --> 00:37:03.840
So we're seeing a lot around the government, national security, and cultural differences that we've spoken we've spoken about throughout the podcast.
00:37:04.079 --> 00:37:08.719
Compared with the GDPR, the PDPL is slightly more governance-driven.
00:37:09.039 --> 00:37:27.199
The GDPR frames automated decision making primarily around individuals' rights, whereas the PDPL blends that with Saudi Arabia's national data sovereignty model, meaning some AI uses may face stronger central oversight.
00:37:27.679 --> 00:37:37.519
So, in short, the PDPL allows AI and pro it does allow AI profiling, but it regulates them through a principle-based, risk-based approach.
00:37:37.679 --> 00:37:47.840
Organizations must stay transparent, they have to justify their data use, protect sensitive data and biometric data, and maintain human oversight.
00:37:48.000 --> 00:37:51.519
So again, it's you know it is quite close to the GDPR.
00:37:51.599 --> 00:38:07.440
There are differences, and I would say philosophical differences as well, but it wouldn't be a huge jump for somebody that's been working in the GDPR to, you know, to to work with this law or to be, you know, to be compliant with the law as well.
00:38:08.480 --> 00:38:16.960
So, okay, so the next question then for you, Katie, is Does the PDPL require organizations to appoint a data protection officer?
00:38:17.039 --> 00:38:26.400
So again, we saw last week in India that a data protection officer only needs to be appointed when the data fiduciary is seen as significant.
00:38:26.559 --> 00:38:28.639
So for significant data fiduciaries.
00:38:28.880 --> 00:38:31.440
How about in the uh in the PDPL?
00:38:31.679 --> 00:38:32.159
What's that?
00:38:32.320 --> 00:38:33.199
What's that like?
00:38:34.000 --> 00:38:47.119
So yeah, some again, kind of like the Indian law, some controllers are going to need to appoint a DPO, and the per that's provided for under Article 30.
00:38:47.360 --> 00:38:49.199
Um, but there are conditions.
00:38:49.440 --> 00:39:05.440
So the conditions are where a company carries out large-scale monitoring, handles sensitive personal data as a core activity, or operates as a public entity with significant processing responsibilities.
00:39:05.760 --> 00:39:15.440
So the Society Data and AI Authority has published a couple of kind of guiding literatures here.
00:39:15.599 --> 00:39:41.280
So they said to determine if you fall under one of these categories, and consider things like the number of data subjects you handle, the actual volume of the personal data, what's the type of personal data, what's the geographical scope of your processing, and what are the categories of data subjects that you handle.
00:39:41.599 --> 00:39:50.559
So that's the kind of things to consider if you're asking do we carry out large-scale monitoring?
00:39:51.119 --> 00:39:58.400
Um it's kind of similar to the to the Indian law, then, is it?
00:39:58.480 --> 00:40:03.039
So it's it's only when there's high risk processing taking place.
00:40:03.840 --> 00:40:10.000
Yeah, basically, or a public entity with significant responsibility.
00:40:10.079 --> 00:40:14.880
So I suppose that could you could kind of use the same guidance there.
00:40:15.119 --> 00:40:20.079
Or if you if handling sensitive personal data is a core activity.
00:40:20.320 --> 00:40:29.119
So again, financial institutions and healthcare and hospitals and so on, yeah.
00:40:29.679 --> 00:40:30.079
Yeah.
00:40:30.960 --> 00:40:44.400
Um so they need to document their equipment of a DPO, and whether they're an internal employee or external, um, they don't need to be internal.
00:40:44.880 --> 00:41:01.360
And so the DPO's responsibilities, very much like the GDPR, monitoring compliance, advising on obligations, training staff, uh point of contact for the for the SDAIA.
00:41:02.320 --> 00:41:09.840
Um there is guidance out there of like what kind of qualifications a DPO should have.
00:41:09.920 --> 00:41:13.039
So there's a few considerations they put out there.
00:41:13.199 --> 00:41:28.000
Um they need to have the appropriate academic qualifications and experience, they need to have a knowledge of risk management practices, knowledge of the regulatory requirements and so knowledge of the law.
00:41:28.559 --> 00:41:38.559
Um interestingly, they need to be um an honest, they need to be a person that demonstrates honesty and integrity.
00:41:39.119 --> 00:41:46.800
So they also can't have been convicted of any offence involving dishonesty or a breach of trust.
00:41:47.119 --> 00:41:52.960
So um those two considerations seem to be kind of independent of each other.
00:41:53.199 --> 00:42:00.880
So the honesty and integrity, and then not been convicted of any offence involving dishonesty or a breach of trust.
00:42:01.119 --> 00:42:16.800
So that's to me, that's a nice addition, but I'd just love to know what way they're going to consider whether someone is honest and you know, the integrity and honesty of person are just being interact, you know.
00:42:17.360 --> 00:42:20.320
Maybe it's a background check or something they may have to do.
00:42:21.360 --> 00:42:22.079
Yeah, true.
00:42:22.239 --> 00:42:32.960
I'd that's just my personal I'd you know, I just like to know the the kind of thought patterns of whoever's appointing them, of what they are gonna be, you know, is there gonna be criteria?
00:42:33.119 --> 00:42:35.920
Is there gonna be like a code of practice?
00:42:36.800 --> 00:42:51.599
Maybe there's more out there than but yeah, so they're conceptually similar, but it is it is a bit more like the Indian DPDP than the GDPR when it comes to the appointment of a DPO.
00:42:52.400 --> 00:43:05.119
I think that's an interesting consideration as well, that they you know, they look for a trustworthy individual, they may check their background to see if they have any kind of criminal record or kind of any kind of wrongdoing.
00:43:05.360 --> 00:43:10.880
It kind of reflects the importance that they put on data and personal data, you know.
00:43:11.360 --> 00:43:12.960
Yeah, yeah, yeah.
00:43:13.199 --> 00:43:13.679
Yeah.
00:43:13.920 --> 00:43:17.840
So, like like somebody in Europe said, data is a new oil.
00:43:17.920 --> 00:43:25.599
So I suppose, especially for Saudi Arabia, important to protect personal data, like oil.
00:43:26.559 --> 00:43:49.519
Yeah, I think it's another to me, it's another example of how they keep kind of considering personal data in more of a community-based understanding rather than individualistic because it keeps coming back, you know, thinking about not just the effect on the individual, but you know, kind of the broader effects on larger groups of people.
00:43:49.920 --> 00:43:58.960
You know, absolutely, and the country itself, you know, and the state, it's very kind of emphasized in the law, I would say.
00:44:00.079 --> 00:44:00.559
Yeah.
00:44:01.280 --> 00:44:03.199
Nice to note those differences.
00:44:11.360 --> 00:44:14.559
We'll move on to the next question here for you.
00:44:14.800 --> 00:44:20.239
Maria, what counts as personal as a personal data breach?
00:44:20.400 --> 00:44:24.960
So what what is a personal data breach and what do organizations need to do?
00:44:25.519 --> 00:44:26.639
Okay, thanks, Kaylee.
00:44:26.719 --> 00:44:38.559
So I think it's this is really an interesting area as well because a personal data breach under the PDPL is defined very broadly, not just about a hackers trying to hack into the organization.
00:44:39.039 --> 00:44:51.199
It includes any kind of incident or accidental or intentional breach of personal data as well that leads to loss or alteration or disclosure or unauthorized access to personal data.
00:44:51.360 --> 00:45:03.679
So it could actually be also internal, like if somebody internally, like a nosy person checking somebody's health record, you know, or something like that, that would be seen as a breach as well.
00:45:03.840 --> 00:45:30.159
So a cyber attack counts, of course, but so do everyday mistakes like emailing data to the wrong person within the organization, losing a laptop, misconfiguring a cloud service where data is personal data is is breached, or exposing within the environment within the cloud environment as well, or exposing information through poor access controls to employees that shouldn't have access to that kind of personal data.
00:45:30.320 --> 00:45:31.920
So that's really interesting, you know.
00:45:32.079 --> 00:45:44.000
And again, I think that, like you say, it might go back to the kind of community or cultural thing about exposing personal data to people within the community that shouldn't have access to that data.
00:45:44.159 --> 00:46:00.079
You know, like like you say, it's kind of private, not just out for protecting people from outside the country, but it's also it seems to be to protect people from even people from in the the culture or from in within the community, you know.
00:46:00.639 --> 00:46:02.480
So there seems to be a trend there.
00:46:02.639 --> 00:46:06.480
So the PDPL focuses on the likelihood of harm.
00:46:06.719 --> 00:46:20.320
If the incident could affect someone's privacy, their dignity, which is important and interesting, financial security or their you know their their human rights, the organization must treat it as a breach and take action.
00:46:20.559 --> 00:46:23.840
This reflects Saudi Arabia's emphasis on trust.
00:46:24.000 --> 00:46:29.280
Again, we're that's coming up again, strong governance around national data assets.
00:46:29.440 --> 00:46:41.280
So when a breach occurs, the organization must notify the Saudi authority or the SDAIA and the regulator as soon as it becomes as soon as the organization becomes aware of the breach.
00:46:41.599 --> 00:46:54.079
There's no fixed kind of 72-hour rule like we have in the GDPR, but the expectation is you know, make sure it's prompt reporting, especially when sensitive or high-risk data is involved.
00:46:54.239 --> 00:47:07.440
If the breach is likely to cause harm to the individuals, the organization must also notify the individuals of the breach and explain what happened, what data was exposed, and what steps they should take to protect themselves.
00:47:07.519 --> 00:47:24.320
So again, you have you have a similar kind of procedure as the GDPR, but kind of more of an emphasis on protecting the individual from not just external threats but also within the community or within even within their workplace, you know.
00:47:24.559 --> 00:47:38.159
So the PDPL also requires immediate remedial action, similar to the GDPR, containing the breach, preventing further exposure, restoring data if possible, and reviewing internal safeguards to avoid repeat incidences.
00:47:38.239 --> 00:47:41.519
So again, the breach procedure is very similar to the GDPR.
00:47:41.840 --> 00:47:52.639
Organizations also document the response because the Saudi authority should, or you know, the regulator may request evidence of how the incident was handled.
00:47:52.800 --> 00:47:56.239
So compared to the GDPR, the overall structure is very similar.
00:47:56.480 --> 00:48:04.960
Both require reporting, transparency, and mitigation, but again, the PDPL places emphasis on central oversight.
00:48:05.199 --> 00:48:17.440
Uh, the the supervisory authority or the SDAIA has stronger authority to intervene and impose controls or restrict processing in higher risk situations.
00:48:17.679 --> 00:48:30.079
You know, breaches include any incident that compromises personal data, and organizations must report it or notify individuals if harm is possible, similar to the GDPR.
00:48:31.119 --> 00:48:35.679
So, Katie, this brings us to our last question, which is for you.
00:48:36.000 --> 00:48:44.239
And the question is: what are the penalties for non-compliance and how does the PDPL enforce non-compliance?
00:48:45.760 --> 00:49:00.000
So it does come with quite substantial administrative fines, up to 5 million Saudi Riel, with the potential for doubled penalties if an organization commits repeat violations.
00:49:00.880 --> 00:49:04.719
So quite a good deterrent there.
00:49:05.039 --> 00:49:17.360
But they also have a couple of criminal penalties of imprisonment fines for unlawful disclosure of sensitive data or illegal across border data transfers.
00:49:18.159 --> 00:49:20.880
So quite a bit more severe there.
00:49:22.719 --> 00:49:38.800
The enforcer of these penalties is the FDAIA, and the regulators have shown willingness to enforce, especially in situations of national security and public trust.
00:49:39.119 --> 00:49:44.000
So that's an almost you know, national security public trust.
00:49:44.079 --> 00:49:48.000
That's in about every second question nearly that we went through.
00:49:48.159 --> 00:49:50.000
So it's very important to them.
00:49:51.840 --> 00:49:58.559
And it's also evidenced by the fact that they are willing to put people in prison if they breach if they breach the law.
00:50:00.159 --> 00:50:11.039
Um especially for the cross-border illegal cross-border transfers that they can into with criminal penalties.
00:50:11.519 --> 00:50:16.639
Um so it it is quite different to the GDPR in that sense.
00:50:16.960 --> 00:50:22.880
Actually, um GDPR relies mainly on administrative fines.
00:50:24.000 --> 00:50:24.800
That's it.
00:50:25.039 --> 00:50:27.599
I mean criminal liability.
00:50:34.159 --> 00:50:35.440
No, absolutely.
00:50:35.760 --> 00:50:48.239
And I think probably yeah, and that I think that probably falls on the leaders, like the you know, I would say that would probably be the CEO or managing directors or the board or so on, um of organizations.
00:50:50.000 --> 00:50:50.960
Yeah, hopefully not.
00:50:51.519 --> 00:50:58.400
I wonder, does the DPO have that independence like it does under the GDPR?
00:50:59.599 --> 00:51:02.400
That might be an interesting question to ask.
00:51:19.199 --> 00:51:29.280
So the DPO under the Saudi PDPL does not have the same level of statutory independence as the GDPR PR DPO.
00:51:30.000 --> 00:51:30.159
Okay.
00:51:31.199 --> 00:51:32.559
It's not in the same way.
00:51:32.719 --> 00:51:37.280
Under the GDPR, the data protection officer is a legally protected role.
00:51:37.440 --> 00:51:41.440
They must act independently and cannot cannot be dismissed, as we know.
00:51:41.599 --> 00:51:48.400
Um, but under the Saudi PDPL, the level of independence isn't explicitly built into the law.
00:51:48.559 --> 00:52:04.079
So the PDPL does allow organizations to appoint someone responsible for privacy oversight, but it doesn't include the GDPR style protections around independence, job security, and guaranteed access to leadership.
00:52:04.800 --> 00:52:08.320
Instead, the PDPL takes a governance-driven approach.
00:52:08.480 --> 00:52:23.519
The person overseeing data protection must ensure compliance with the law, support internal controls, manage breach notifications, and coordinate with the uh the Saudi regulator, but they operate within the organization's normal management structure.
00:52:24.719 --> 00:52:33.280
So the version of a DPO under the D the PDPL is more of a compliance coordination role rather than an independent statutory officer.
00:52:34.159 --> 00:52:35.280
That's interesting.
00:52:36.159 --> 00:52:37.119
That is, yeah.
00:52:37.840 --> 00:52:46.639
And that has that could have different implications for the DPO and how they conduct themselves in the organization, you know?
00:52:47.519 --> 00:52:55.280
Yeah, that kind of honest integrity consideration is quite important in light of that.
00:52:56.000 --> 00:53:12.880
Conflict of interest could be um an issue for DPOs taking taking up the role of a DPO in in the Kingdom Saudi Arabia, Kingdom of Saudi Arabia, because if they don't have that protection they won't feel as competent to call out wrongdoing, you know.
00:53:14.000 --> 00:53:14.559
Yeah.
00:53:15.360 --> 00:53:19.599
So the the integrity of the individual is very important then in that respect.
00:53:20.320 --> 00:53:20.719
Great.
00:53:20.800 --> 00:53:22.239
So thanks, Katie, for that.
00:53:22.400 --> 00:53:25.760
That was a really interesting uh final question.
00:53:26.400 --> 00:53:30.880
So that brings us to the end of our walkthrough of the Saudi PDPL.
00:53:31.039 --> 00:53:40.320
Hopefully, this discussion gives you a clear understanding of how the law works, where it aligns with the GDPR, and where the key differences lie.
00:53:40.880 --> 00:53:43.840
Thank you, Katie, for joining me again today.
00:53:44.000 --> 00:53:46.719
And thank you to our listeners for tuning in.
00:53:46.800 --> 00:53:58.400
Um, don't forget to subscribe, and we'll see you in the next episode as we continue to explore our global privacy data protection and AI governance podcast.
00:53:58.880 --> 00:53:59.760
Thanks, Maria.
00:54:00.480 --> 00:54:01.280
Thanks, everyone.
00:54:01.360 --> 00:54:02.159
Thanks, Katie.
00:54:02.480 --> 00:54:19.599
Take care of the
