On March 19, 2024, the Saudi Data & Artificial Intelligence Authority (SDAIA) requested via a post on X (formerly Twitter) public comments on the draft amendments to the Regulations on personal data transfers.

What are the main amendments to the Regulations on personal data transfers?

In particular, the amendments provide that other purposes of transfer or disclosure of personal data to entities outside Saudi Arabia are, in accordance with Article 29(1)(d) of the Personal Data Protection Law (PDPL):

• performing processes necessary for central processing to enable the controller to perform its activities;
• providing a service or benefit to the data subject; and
• conducting scientific research and studies.

The amendments also set out the procedures and standards for assessing the level of personal data protection outside Saudi Arabia, which include:

• existence of regulations that guarantee the protection of personal data and rights of data subjects, including the right to claim compensation for damage resulting from breach of such rights;
• presence of a supervisory authority and readiness of the supervisory authority to cooperate with the competent authority in Saudi Arabia regarding matters related to personal data protection; and
• non-contradiction of regulatory requirements for disclosure of personal data under legal provisions applicable by the state or international organization with provisions of disclosing personal data stipulated by the PDPL and its implementing regulations, and non-contradiction of such provisions with any other provisions applicable in Saudi Arabia regarding disclosure.

Moreover, the amendments provide for cases where the data transfer can be done based on appropriate safeguards. The amendments define appropriate safeguards as requirements imposed by the competent authority on the controllers, ensuring compliance with provisions of the PDPL and its implementing regulations, when transferring or disclosing personal data to entities outside of Saudi Arabia in any case of exemption from conditions for availability of appropriate protection level of personal data or the minimum limit of personal data, as the case may be, with the aim of guaranteeing appropriate level of personal data protection outside Saudi Arabia that shall not go below the level stipulated by the PDPL and its implementing regulations.

Furthermore, the amendments provide for cases in which controllers shall conduct a risk assessment of the transfer or disclosure of personal data.

Public comments can be submitted here until April 18, 2024.

You can read the draft here and read the post, only available in Arabic, here.