Legal Protection of Personal Data Privacy in the Kingdom of Saudi Arabia

Wael Mohammed Nusairat

 

Abstract: The Kingdom of Saudi Arabia is one of the leading countries and the initiator of enacting systems that respect and preserve the sanctity of personal data and criminalise its violation in any illegal manner. Royal Decree No. (19) dated 2021 was issued to establish the personal data protection system in the Kingdom of Saudi Arabia, and to begin a new era in improving the handling of personal data. With personal data and the necessary legal guarantees to protect it and to preserve the privacy of individuals, protect their rights, and enhance responsibility among individuals and other entities. This article examines the criminal law protection of individual’s personal data in cyberspace by analysing the legal framework applied in Saudi Arabia. With the analysis of the nature of individuals’ personal data and the forms of abuse against it, this article pursues effective means of protection regarding service providers, processors, and third parties. Highlighting the most prominent efforts made by the Saudi Data and Artificial Intelligence Authority (SDAIA), which is represented by the National Data Management Office, in the protection of personal data, this article identifies shortcomings by comparing the Saudi personal data protection policy with the European Union’s General Data Protection Regulation (GDPR). The findings of this article are useful for legislators in Saudi Arabia to review the new Personal Data Protection Law and to develop a proactive policy in detecting and dealing with incidents and breaches of data before they occur.