On September 3, 2024, the Saudi Data & Artificial Intelligence Authority (SDAIA) shared via LinkedIn three guidelines intended to support the implementation of the provisions of the Personal Data Protection Law (PDPL) and its Regulations and encourage entities to adopt best practices. SDAIA published the following guidelines: Personal Data Disclosure Cases Guideline (guidelines on disclosure cases); Personal Data Processing Activities Records Guideline (guidelines on processing records); Personal Data Destruction, Anonymization, and Pseudonymization Guideline (guidelines on destruction, anonymization, and pseudonymization). Disclosure cases In particular, the guidelines on disclosure cases
News
Saudi Arabia: SDAIA publishes further guidelines to support PDPL compliance
September 4, 2024
Summary
The Saudi Data & Artificial Intelligence Authority (SDAIA) released three guidelines on September 3, 2024, to aid compliance with the Personal Data Protection Law (PDPL) and its Regulations. These guidelines cover disclosure cases, processing records, and destruction, anonymization, and pseudonymization of personal data. They clarify when personal data can be disclosed, detail the records that must be kept, including data protection officer information and data retention periods, and outline requirements for data destruction and anonymization, including impact assessments and re-identification risks.