Saudi Arabia: Published Implementing Regulation of the Personal Data Protection Law

On 7 September 2023, the final version of the Implementing Regulation of the Personal Data Protection Law (PDPL) was published. The Implementing Regulation outlines the data subject rights, such as the right to be informed on the purpose of data collection and access, access, rectify, and delete personal data and withdraw consent. Furthermore, the regulation outlines the legal basis for personal data collection and processing and outlines the controllers' obligations. The Implementing Regulation will be enforced once the PDPL becomes effective; the PDPL will be fully implemented on 14 September 2024, after the lapse of a one-year grace period.