Saudi Arabia: Implemented SDAIA Minimum Personal Data Determination Guideline

On 30 August 2024, the Minimum Personal Data Determination Guideline issued by the Saudi Arabia Authority for Data and Artificial Intelligence (SDAIA) entered into force. The Guideline establishes that the minimum collection of personal data refers to the practice of collecting only the personal data that is strictly necessary and directly relevant to the purpose for which it is being collected. To this end, the Guideline requires controllers to conduct regular assessments to evaluate the personal data they retain in order to identify and destroy data that is no longer necessary to fulfill the purposes for which it was collected. Likewise, data that is not relevant to the primary purpose of collection should also be destroyed.