Saudi Arabia: SDAIA Personal Data Destruction, Anonymisation, and Pseudonymisation Guideline

Implemented Personal Data Protection Law Amendments including data protection regulations

Entry into force of Implementing Regulation of the Personal Data Protection Law

Entry into force of Regulations for transferring personal data outside the geographical borders of the Kingdom of Saudi Arabia

Implemented Personal Data Protection Law Amendments including data protection authority governance

Implemented Personal Data Protection Law Amendments including cross-border data transfer regulation

Published SDAIA Personal Data Processing Activities Records Guideline

Implemented SDAIA Guidelines for Binding Common Rules (BCR) for Personal Data Transfer

Implemented SDAIA Standard Contractual Clauses for Personal Data Transfer

Entry into force of Regulations for transferring personal data outside the geographical borders of the Kingdom of Saudi Arabia

Implemented SDAIA Minimum Personal Data Determination Guideline

Adopted SDAIA’s Rules for Appointing Personal Data Protection Officer

Closed consultation on SDAIA Draft Rules Governing the National Register of Controllers Processing Personal Data

Postponed implementation of Personal Data Protection Law based on 2023 amendments

Closed consultation on Framework on Use of Secondary Data

Implemented Data and Privacy Regulatory Sandbox

Adopted Data Management and Personal Data Protection Standards

Adopted National Data Governance Policy including Cross-Border Data Transfer Regulation

Adopted Data Protection Regulation in National Data Governance Policy