Saudi Arabia: Entry into force of Implementing Regulation of the Personal Data Protection Law including cybersecurity regulation

On 14 September 2024, the Implementing Regulation of the Personal Data Protection Law (PDPL) became effective alongside the PDPL itself. It stipulates that data controllers must implement comprehensive security measures to safeguard personal data and privacy. In the event of a data breach, the controller is obliged to notify the authority within 72 hours, providing a detailed account of the incident and the corrective measures that have been or will be taken. Furthermore, data controllers are required to notify affected data subjects if a breach may cause damage to their data or conflict with their rights or interests.