Saudi Arabia: Entry into force with grace period of Personal Data Protection Law Amendments including data protection regulations

On 14 September 2023, the Personal Data Protection Law Amendments entered into force with a grace period of one year. Firstly, the amendments outline the subject data rights, including the right to be informed on the purpose of data collection and access, rectify and delete personal data. Secondly, the amendments state that entities collecting and processing personal data have to obtain consent from data subjects and outline exceptions in which data processing is not subject to the consent requirement. Finally, the amendments note that entities collecting and processing personal data have to adopt a privacy policy and provide it to data subjects. The foreign entities processing the data of individuals located within the country, including the personal data of deceased individuals, will have to comply with the data processing requirements.