Personal Data Protection Law, publicly available source ground
Royal Decree No. M/19, Arts. 10, 15 publicly available source ground (9/2/1443H, 16 September 2021)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A personal data rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Do not assume Saudi personal data is outside the Personal Data Protection Law merely because it is publicly available; public availability, or having been collected from a publicly available source, is only a ground for collecting, repurposing, or disclosing it without the Data Subject's consent, not an exemption from the Law's other duties.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Personal Data Protection Law does not exempt publicly available personal data from its scope. Article 10 lists the Personal Data already being publicly available, or having been collected from a publicly available source, as one of several grounds on which a Controller may collect it from a source other than the Data Subject or repurpose it without the Data Subject's consent. Article 15 lists the same ground for disclosing Personal Data.
Personal data scraped from a publicly available Saudi source therefore does not need the Data Subject's consent on this specific ground, but it remains subject to the Law's other duties, including purpose limitation, accuracy, security, breach notification, and the Data Subject's rights. Article 43 provides that the Law comes into force 720 days after its Official Gazette publication date; no source located states that publication date, so this Law's specific commencement day is not confirmed.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
Read the law
official Personal Data Protection Law text, SDAIA document library