Saudi Arabia: Opened consultation on SDAIA’s draft rules for appointing personal data protection officer

On 8 July 2024, the Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation on the draft rules for appointing a Personal Data Protection Officer (DPO) until 6 August 2024. The draft rules set minimum requirements for appointing DPOs, including adequate qualifications in data protection, knowledge of regulatory measures, and ethical integrity. The draft rules also contain provisions on DPO appointments for entities processing large-scale personal data, engaging in systematic data monitoring, or handling sensitive data. The draft rules expand the responsibilities of DPO to include policy development, overseeing data breach response plans and preparing compliance reports.