The amendments to the Personal Data Protection Law, implemented by Royal Decree M/19 of 17 September 2021 approving Resolution No. 98 dated 14 September 2021 ('PDPL, as amended') were published by the Bureau of Experts at the Saudi Council of Ministers, following their approval by the Council of Ministers, on 21 March 2023. In particular, according to Article 43 of the PDPL, as amended, the same shall enter into force 720 days from the date of publication in the Official Gazette (i.e. 24 September 2021), namely on 14 September 2023. In addition, according to the preamble of the PDPL, as amended, entities will have a one-year transition period from such date to bring their operations into compliance.

Further to the above, the finalised amendments retain the main changes included in the draft version. Notably, the PDPL, as amended, allows the transfer or disclosure of personal data outside Saudi Arabia, however only to achieve certain purposes, and provided that the following conditions are met (Article 29 of the PDPL, as amended):

• the transfer or disclosure shall not prejudice the national security or vital interests of Saudi Arabia;
• the country to which the personal data is transferred protects personal data to at least the same standard as Saudi Arabia, according to the results of an evaluation conducted by the competent authority in this regard in coordination with those concerned; and
• the transfer or disclosure should be limited to the minimum amount of personal data that is required.

Nevertheless, Article 29(3) of the PDPL, as amended outlines that the above conditions shall not apply in case of extreme necessity to preserve the life of the data subject or their vital interests, or to prevent, examine, or treat a pathological infection.

You can read the PDPL, as amended, only available in Arabic, here.