Every business that collects a name and a mobile number or email address from a customer, an employee or a visitor to its website is processing personal data, and so the Personal Data Protection Law applies to it. The problem is not the collection, but that it happens with no basis, no policy and no controls.
Who does the Law apply to?
It applies to any processing of personal data carried out by an entity inside the Kingdom by any means, and to anyone outside it who processes the data of residents of the Kingdom. The body competent to supervise it is the Saudi Data and Artificial Intelligence Authority (SDAIA).
The basis for processing: why do you collect this data?
In principle data is processed with the consent of its owner, and the Law has exceptions it sets out. What matters is to know on what basis you process each type of data, and that the purpose is specific and declared. Whoever collects more data than he needs, or keeps it longer than necessary, exposes himself to a violation.
The practical obligations of the business
- Publish a clear privacy policy at the point of collection, showing what is collected, why and with whom it is shared.
- Limit collection to the minimum data needed for the purpose.
- Set the retention period and destroy the data when the purpose ends.
- Adopt security measures suited to the nature of the data.
- Enable data subjects to exercise their rights: access, correction, erasure and withdrawal of consent.
- Report data breaches to the competent authority as the regulations specify.
- Control the transfer of data outside the Kingdom under the statutory conditions.
- Clear contracts with anyone who processes data on your behalf, such as hosting and marketing companies.
Sensitive data needs more care
Such as health, credit, religious, criminal and biometric data. It is subject to stricter controls, so review its rules before you collect or share it.
Where to start? Five steps
- Map your data: what you collect, from where, where it is stored, and who has access to it.
- Review your website forms, bulk messages and employment contracts for the basis and the disclosure.
- Write a privacy policy that matches what you actually do, not what you wish you did.
- Prepare a breach-response plan: who reports, when, and in what form.
- Train the people who handle data, because most leaks have a human cause.
Penalties
The Law provides financial and criminal penalties according to the violation, and they may be multiplied for sensitive data or disclosure intended to cause harm. So the matter deserves early review, not remedying after the incident.