Binding law — in force
Under Art. 4(5) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, a controller whose activities include, on a large scale or repeatedly, making decisions based on automated processing of personal data must take the necessary measures to tell the data subject what Art. 4(1) requires and, in addition, whether decisions will be based entirely on automated processing of personal data ((c)), with the means of collecting and processing sensitive data and the measures taken to protect personal data ((a)-(b)). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect a privacy notice that never says whether decisions are automated.
sa-pdpl-regs.automated-decision-notice · Implementing Regulation of the PDPL, Art. 4(5), including (c) (information on decisions based entirely on automated processing) · official source · jurisdictions: SA
The guard to add, and how far to trust this rule
Binding law — in force
Under Art. 11(2)(c) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, the data subject's consent must be explicit where decisions will be based entirely on automated processing of personal data; explicit consent is consent given directly and explicitly, in any form, that shows acceptance of the processing, cannot be read otherwise and can be proven (Art. 1(9)). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect model output that decides about a person with no explicit-consent check and no person deciding first.
sa-pdpl-regs.explicit-consent-for-automated-decisions · Implementing Regulation of the PDPL, Art. 11(2), including (c) (explicit consent where decisions are based entirely on automated processing) · official source · jurisdictions: SA
The guard to add, and how far to trust this rule
Binding law — in force
Under Art. 25(1)(c) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, a controller must prepare a written and documented assessment of the potential impacts and risks to data subjects of processing their personal data where its activity includes, on a large scale or repeatedly, making decisions based on automated processing of personal data (among other cases). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect the absence of an impact assessment for the automated decision system.
sa-pdpl-regs.impact-assessment-for-automated-decisions · Implementing Regulation of the PDPL, Art. 25(1), including (c) (impact assessment where the controller's activity includes decisions based on automated processing) · official source · jurisdictions: SA
The guard to add, and how far to trust this rule
