The Saudi Data & AI Authority (SDAIA) has issued new rules for appointing Personal Data Protection Officers (DPOs).

These rules are in line with Saudi Arabia Royal Decree No. M19/1443 On the Approval of the Personal Data Protection Law and amended pursuant to Saudi Arabia Cabinet Decision No. 604/1444, and Saudi Arabia Administrative Decision No. 1516/1445 on Implementing Regulation of the Personal Data Protection Law.

The rules aim to set minimum requirements for DPO appointments, clarify cases where a DPO must be appointed, and outline the roles and responsibilities of DPOs.

Controllers must appoint a DPO if they are a public entity processing personal data on a large scale, if their core activities involve regular and systematic monitoring of data subjects, or if their core activities involve processing sensitive personal data, as per Article 5 of the rules.

The rules provide criteria for determining what constitutes large-scale processing and regular and systematic monitoring.

The DPO must have appropriate academic qualifications, experience in data protection, knowledge of risk management practices, and regulatory requirements, as stated in Article 4 of the rules.

They can be an employee of the controller or an external contractor.

The appointment must be documented, and the DPO’s contact details must be provided to SDAIA and made accessible to data subjects, as per Articles 6 and 7 of the rules.

The rules outline the DPO’s roles and tasks, including advising on data protection policies, contributing to data breach response plans, preparing reports on the controller’s data processing activities, and following up on regulatory updates from SDAIA, as stated in Article 8 of the rules.

Controllers must enable and support the DPO in performing their duties, provide necessary resources, and ensure the DPO’s independence, as per Article 9 of the rules.

The rules also encourage training and professional development for DPOs.

The new rules aim to enhance personal data protection in Saudi Arabia by ensuring that organisations handling personal data have dedicated personnel responsible for monitoring compliance with Saudi Arabia Royal Decree No. M19/1443 and Saudi Arabia Administrative Decision No. 1516/1445.

For more news and content, try Lexis Middle East. Click on lexis.ae/demo to begin your free trial of Lexis® Middle East platform.

You can also explore the legal landscape by subscribing to our Weekly Newsletter.

Want to learn more about Lexis® Middle East? Visit https://www.lexis.ae/lexis-middle-east-law/.