Saudi Arabia: Entry into force with grace period of Personal Data Protection Law Amendments including cross-border data transfer regulation

On 14 September 2023, the Personal Data Protection Law Amendments entered into force with a grace period of one year. Firstly, the Law stipulated that the transfer of data would be allowed to other jurisdictions if it does not prejudice the Kingdom's national security. Secondly, the transfers would be permitted if sufficient guarantees to preserve the personal data that will be transferred are in place and the protections are equal or higher to those applicable in Saudi Arabia. Thirdly, the Law specifies that the minimum amount of personal data required should be transferred. Finally, the Law specifies that the competent authority has to approve the transfers and has the power to exempt entities from acquiring approval before transferring personal data to other jurisdictions.