Saudi Regulation on Personal Data Transfer Outside the Kingdom

Keep a written justification for each export flow: (i) it falls within a purpose permitted by PDPL Article 29(1) or one of the three “other purposes” specified in Article 2 of this Regulation (necessary central processing, providing a service or benefit to the data subject, scientific research and studies); (ii) it does not prejudice national security or the Kingdom’s vital interests; (iii) an adequate level of protection exists outside the Kingdom, at least equivalent to that under the Law and Regulations; and (iv) it is limited to the minimum personal data needed. Article 29(3) disapplies the three conditions in cases of extreme necessity to preserve the life or vital interests of the data subject or to prevent, examine or treat disease.

Applies when

All controllers transferring personal data out of the Kingdom or disclosing it to parties outside it.

Evidence to retain

• · Export flow register (purpose, legal basis, recipient, data categories, volume)
• · Minimisation reasoning and field-level evidence (pre- and post-transfer field comparison)
• · Internal review note on national security and vital interests
• · Adequacy assessment conclusion and supporting material

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Article 4(1) requires a controller relying on an exemption to implement one of: standard contractual clauses, binding common rules, or a certificate of accreditation. Article 4(2) sets out five exemption cases and their requirements: transfers between public bodies to implement an agreement to which the Kingdom is a party or to serve its interests must include standard personal data protection provisions in the relevant agreements or memoranda; non-recurring or time-limited transfers involving a limited number of data subjects must comply with the standard contractual clauses, or go to a recipient holding an approval certificate from an entity licensed by the Competent Authority with non-sensitive data; transfers necessary for central operations within a group of multinational entities require the controller and its affiliates to comply with binding common rules or the standard contractual clauses, or the recipient to hold an approval certificate; transfers to provide a service or benefit directly to the data subject without violating their expectations or interests must go to a certified recipient with non-sensitive data; and transfers necessary for scientific research and studies must be limited to the minimum data required and comply with the standard contractual clauses or go to a certified recipient with non-sensitive data. Article 4(3) requires the safeguards to ensure compliance with the Law and Regulations and to protect data subjects’ rights, including the right to complain to the Competent Authority and to seek compensation.

Applies when

The case most Chinese AI companies land in is “necessary central operations within a multinational group”: where a China- or Singapore-based training platform, data lake, support or HR system processes Saudi data, binding common rules or the standard contractual clauses must cover the controller and all affiliated processing parties.

Evidence to retain

• · Executed SDAIA standard contractual clauses or approved binding common rules
• · Recipient’s accreditation certificate and evidence the issuing body is licensed (where the certification route is used)
• · Memo classifying each flow against the five cases in Article 4(2)
• · Verification that the safeguards operate (access control, complaint and compensation channel, exercise of audit rights)

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Article 7(1) requires a risk assessment before transfer in two cases: transfers or disclosures made under the Article 4 exemptions, and continuous or widespread transfer or disclosure of sensitive data outside the Kingdom. Article 7(2) requires the assessment to cover at least six elements: the purpose and legal basis for the transfer; a description of its nature, including the processing activities involved and their geographical scope; the appropriate safeguards implemented and their adequacy in ensuring a level of protection not less than that prescribed by the Law and Regulations; the measures used to limit the transfer to the minimum data required, in cases not exempted under Article 29(2)(c); the potential material or moral effects of the transfer and the likelihood of their occurrence; and the measures or controls to prevent potential risks or mitigate their effects. SDAIA’s Risk Assessment Guideline should be the baseline for the template.

Applies when

Every category of transfer relying on an exemption, and any continuous or widespread export of sensitive data (health, genetic, biometric, credit, religious or political views).

Deadline: Complete before the transfer takes place.

Evidence to retain

• · Transfer risk assessment report covering the six elements of Article 7(2)
• · Analysis of the destination’s legal environment relied on in the assessment
• · Risk mitigation control list and implementation evidence
• · Re-assessment trigger rules and the history of re-assessments (changes of recipient, data category or legal environment)

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)