Saudi Arabia

Establish a lawful basis and purpose obtain consent where required give notice respect access, copy, correction, update, and destruction rights select and supervise processors that provide sufficient guarantees apply security controls and limit processing to the stated purpose and necessary data. Large-scale monitoring, emerging technologies, sensitive data, linking datasets, vulnerable data subjects, or automated decisions trigger documented impact-assessment and/or additional notice requirements under the implementing regulation. The controller remains responsible when using a processor.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Provides operational rules for notice, data-subject requests, records of processing, processor selection, security, data-protection officers where applicable, impact assessments, complaints, and breach notifications. A controller must notify the competent authority within no more than **72 hours** after becoming aware of a qualifying personal-data breach where a breach may harm the data subject or conflict with rights or interests, notification must be made without undue delay in clear language. Article 25 requires a written impact assessment for, among other cases, sensitive data, data linking, large-scale/repetitive processing of persons lacking full or partial legal capacity, constant monitoring, newly adopted technology, automated decisions, or a product/service likely to cause serious privacy harm.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Preserve rights and consent withdrawal, breach-notification capability, disclosure controls, and the required protection level. A controller may transfer where the destination has an adequate protection level, subject to the regulation and no prejudice to national security or vital interests. Otherwise use an appropriate safeguard: SDAIA standard contractual clauses, binding common rules, an approved certification, or an approved code of conduct, as applicable. A documented risk assessment is mandatory for transfers under the relevant routes and for continuous or large-scale transfers of sensitive data it must cover purpose/legal basis, processing and geography, safeguards, minimisation, likely material/moral effects, and mitigations. SDAIA publishes an adequacy list and SCC templates.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Establish cybersecurity governance, asset and identity controls, secure development and operations, third-party and cloud controls, resilience, incident response, and continuous compliance. The incident/threat domain includes approved response plans, classification, reporting to NCA where required, and sharing notifications, threat intelligence, indicators, and incident reports.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Secure cloud governance, tenant separation, access, encryption and data protection, incident management, continuity, third-party controls, and data-localization-related requirements. Both CSP and tenant responsibilities must be assigned contractually and operationally, including model-training, logs, support access, backups, deletion, and sub-processing.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Obtain the required license, registration, or notification comply with CST decisions and relevant content, user, and service obligations maintain complaint and operational processes and coordinate with applicable Saudi laws and regulators. The covered categories include satellite pay-TV, IPTV, video OTT, video sharing, audio-on-demand, internet radio, online gaming, e-sports, social media, and online advertising. Deepfake detection can support authenticity, moderation, advertising, and complaint workflows but is not itself a substitute for platform duties.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Identify and verify customers, representatives, and beneficial owners from reliable and independent sources use a risk-based approach understand the purpose and nature of the relationship apply enhanced due diligence for higher risk monitor and update information maintain records and report suspicious transactions. For legal persons, beneficial-owner procedures use the 25% ownership/control threshold, followed by control or senior-management tests where necessary. SAMA directs financial institutions to use the Ministry of Commerce **Wathq** UBO service integration and to report undisclosed or inconsistent UBO information, without prejudice to suspicious-transaction reporting and PDPL.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Electronic records and signatures can satisfy legal form requirements when generated and maintained under the law and its technical requirements. Authentication and integrity evidence matter: an electronic signature is used to identify the signer and detect later alteration records must be retained and made accessible as required.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Disclose provider and transaction information, terms, price, payment and delivery conditions, return/warranty information, and a privacy policy protect consumer data and electronic communications and avoid deceptive or misleading advertising. The Ministry has expressly applied enforcement to misleading social-media advertising.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Financial institutions and designated non-financial businesses/professions must perform customer and beneficial-owner identification/verification, risk-based due diligence, enhanced due diligence where appropriate, ongoing monitoring, suspicious-transaction reporting, and record retention. The law requires records for at least ten years from the end of the transaction or account closure in the cited provision.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.

Direct evidence section in the cited Markdown dossier; official URLs are reproduced from that section.