Saudi Arabia: Closed consultation on SDAIA’s draft rules for appointing personal data protection officer

On 6 August 2024, the Saudi Data and Artificial Intelligence Authority (SDAIA) closes the public consultation on the draft rules for appointing a Personal Data Protection Officer (DPO). The draft rules set minimum requirements for appointing DPOs, including adequate qualifications in data protection, knowledge of regulatory measures, and ethical integrity. The draft rules also contain provisions on DPO appointments for entities processing large-scale personal data, engaging in systematic data monitoring, or handling sensitive data. The draft rules expand the responsibilities of DPO to include policy development, overseeing data breach response plans and preparing compliance reports.