An Overview of Saudi Arabia’s Data Privacy and Cybersecurity Landscape

Yes, Saudi Arabia has a federal data protection law – the Personal Data Protection Law (PDPL). It was introduced in September 2021, and since then, it has undergone Implementing Regulations and Regulations on Personal Data Transfer outside Saudi Arabia.

The GDPR primarily applies to organizations within the EU and the EEA. However, it also applies to organizations outside these regions if they offer goods or services to or monitor the behavior of EU/EEA residents. Therefore, businesses in Saudi Arabia that engage with EU/EEA residents in the ways described by the GDPR would need to comply with its regulations.

The Saudi Authority for Data and Artificial Intelligence (SDAIA) published the second iteration of its Artificial Intelligence Ethics Principles, known as AI Principles 2.0, which provides an ethical framework based on principles for KSA’s usage and advancement of AI technology. Saudi Arabia has also published a Generative AI Guide for the public, which provides guidelines regarding the adoption and use of generative artificial intelligence systems.