Ethical and Regulatory Implications of Cross-Border Personal Data Transfer:

Navigating Saudi Arabia’s Rules in Comparative Perspective

Haifa AlShaikh

Olga Volynskaya

 

Abstract: In line with Saudi Vision 2030, the Kingdom of Saudi Arabia seeks to transition toward a digitally driven, innovation-based economy. As the Kingdom derives its rules from Shari’ah (Islamic law), especially those related to human rights as stipulated under various provisions of the Saudi Basic Law of Governance and, and while Islamic Law prohibits disclosure of private information of individuals and honours individuals’ right to independence in personal affairs, it is of the Kingdom’s interest to further protect the right of privacy of personal information of individuals. Accordingly, the Kingdom’s transition towards digital transformation requires balancing economic growth with the ethical and regulatory challenges posed by cross-border transfers of personal data. While Saudi Arabia’s Personal Data Protection Law (PDPL) and related regulations draw heavily on the EU’s General Data Protection Regulation (GDPR), their restrictive and incomplete implementation creates significant compliance burdens for organisations operating in or with the Kingdom. This article argues that such rigidity risks undermining the Kingdom’s digital ambitions unless the framework evolves toward greater clarity and flexibility. Guided by three research questions—how Saudi rules compare with the GDPR, what ethical principles underpin these frameworks, and what practical compliance challenges arise—the study offers a comparative analysis of Saudi and EU approaches, identifies key legal and organisational gaps, and proposes actionable recommendations to enhance regulatory coherence and support effective compliance.