Publication
Enforcement of KSA’s Personal Data Protection Law postponed
On 24 September 2021, the Kingdom of Saudi Arabia had announced its first standalone personal data protection law (“DP Law”), promulgated by Royal Decree No. M19/1443 (Cabinet Decision No. 98/1443), which was supposed to come into force on the 23 March 2022.
Yesterday, the Saudi Data and Artificial Intelligence Authority (SDAIA) announced on its Twitter account that the competent authorities postponed the full enforcement of the DP Law until 17 March 2023. The reasoning behind this sudden hold is the need to take necessary measures considering recommendations of SDAIA after the public consultation on the draft Implementing Regulations to the DP Law.
SDAIA announced that there will be further consultations in order to enhance the DP Law and encourages stakeholders to participate. The implementing regulations were expected to clarify various aspects, such as cross-border transfer of data and registration requirements. It now remains to be seen which further action will be taken and what the postponement of the DP Law means on a practical level.