Saudi Arabia: Adopted Personal Data Protection Law Amendments including data protection regulations

On 21 March 2023, the Saudi Arabia Council of Ministers adopted the amendments to the Personal Data Protection Law of 2021. The amendments expand the scope of the Personal Data Protection Law. In particular, the foreign entities processing the data of individuals located within the country, including the personal data of deceased individuals, will have to comply with the data processing requirements. Firstly, the amendments outline the data subject rights, including the right to be informed on the purpose of data collection and access, rectify and delete personal data. Secondly, the amendments state that entities collecting and processing personal data have to obtain consent from data subjects and outline exceptions in which data processing is not subject to the consent requirement. Finally, the amendments note that entities collecting and processing personal data have to adopt a privacy policy and provide it to data subjects.