Saudi Arabia: Adopted National Data Governance Policy including Cross-Border Data Transfer Regulation

On 5 May 2020, the National Data Management Office (NDMO) issued provisions on data transfers in general as well as data transfer standards for "minors and incompetents" ("minors"). Any minor personal data should be retained and processed within the Kingdom's borders. However, exceptions may be made if a controller makes a request to the Saudi Data and AI Authority. As for general provisions, according to the policies, retention and processing within the Kingdom are preferred. However, transferring data outside of the Kingdom is possible. The NDMO and Saudi Data and AI Authority (SDAIA) have a country list of accreditations. If a country is on that list, a controller may request approval to retain and process the data outside of the Kingdom from the SDAIA. If a country is not on the list, then controllers may only process data outside of the Kingdom if certain additional protection protocols are respected. This is determined by the organisation's assessment of the risks of said data transfers. The general assessment criteria include the purpose, the time it takes to process, the destination country, implemented security controls, and the data origin. If the risk remains high after taking into account these factors, additional evaluation by taking into account local laws and international obligations. Finally, additional protections for data subjects where the destination country is not on the accreditation list include the implementation of standard contractual clauses, binding common rules, approved rules of conduct, and approved certificates.