Law note · Saudi Arabia
Personal Data Protection Law, cross-border transfer
What it requires
- An app transferring the personal data of an individual in Saudi Arabia to a recipient outside the Kingdom must confirm the transfer does not prejudice national security or Kingdom interests, that the destination affords a level of protection at least equivalent to the Law, and that the transfer is limited to the minimum data needed, following the Transfer Regulation's Appropriate Safeguards or Operational Processes conditions where an adequacy finding is not in place.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voice
What we found
Law Art. 29 permits a Controller to transfer personal data outside the Kingdom only for one of four enumerated purposes (international-agreement obligation, Kingdom interests, a Data Subject's own contractual obligation, or a Regulations-specified purpose), and only where the transfer does not prejudice national security or Kingdom vital interests, an adequate level of protection at least equivalent to the Law's own applies per a Competent Authority assessment, and the transfer is limited to the minimum data needed.
The standalone Regulation on Personal Data Transfer Outside the Kingdom operationalizes this with defined "Appropriate Safeguards" the competent authority may impose where an exemption from the adequacy requirement is granted, and an "Operational Processes" basis for data tied to a controller's own internal operations.
No provision compelling in-Kingdom data storage as a default rule was found; this is a multi-factor national-security-and-adequacy gate rather than either a blanket ban or an open transfer policy, more restrictive in structure than the UAE's or Jordan's equivalent provisions in this batch.
The Regulation's url was corrected on review: the original sdaia.gov.sa path 404s, and the Regulation is now served from SDAIA's Digital Government Platform; the "Appropriate Safeguards" and "Operational Processes" quotes above were re-confirmed against the working url.