The Saudi Authority for Data and Artificial Intelligence (SDAIA) has invited the public and government agencies to submit feedback on draft rules for appointing a Personal Data Protection Officer (DPO), as announced on July 10, 2024. The consultation, hosted on the National Competitiveness Center’s Public Consultation Platform “Istitlaa,” remains open until Tuesday, August 6, 2024. This initiative underscores Saudi Arabia’s commitment to transparent and participatory governance in the rapidly evolving field of data protection.
Context and Background
SDAIA, established in 2019, is the government body responsible for national data and artificial intelligence strategies. It oversees the implementation of the Personal Data Protection System (PDPS), which came into effect in 2023. The PDPS sets out comprehensive requirements for organizations that process personal data, including the appointment of a Personal Data Protection Officer under certain conditions. The draft rules aim to clarify these conditions and establish minimum standards for DPO appointments, ensuring consistent compliance across sectors.
The public consultation is conducted through “Istitlaa,” a platform affiliated with the National Competitiveness Center that enables citizens, residents, and government entities to contribute to regulatory development. This approach reflects SDAIA’s dedication to inclusive policymaking and aligns with Vision 2030’s goals of enhancing government transparency and digital innovation.
Key Details
The draft rules specify when controllers—entities that determine the purposes and means of processing personal data—must appoint a DPO. They also outline the DPO’s responsibilities, which include overseeing the implementation of the PDPS and its executive regulations, monitoring internal data protection procedures, and acting as the primary contact for data subjects and the competent authority. The DPO will also handle requests related to personal data and ensure that the controller complies with SDAIA’s decisions and instructions.
Stakeholders can submit their feedback via the Istitlaa platform at the following link: https://istitlaa.ncc.gov.sa/en/Transportation/NDMO/DPORules/Pages/default.aspx#!. The deadline for submissions is August 6, 2024. SDAIA will analyze all feedback and may adjust the draft rules accordingly before final issuance.
Implications and Impact
This consultation demonstrates SDAIA’s proactive approach to regulating data protection in line with international best practices. By involving the public and government agencies, SDAIA ensures that the rules are practical and widely accepted. For businesses operating in Saudi Arabia, clear DPO appointment criteria will facilitate compliance and reduce regulatory uncertainty. For individuals, the rules strengthen privacy safeguards by ensuring that organizations have dedicated professionals overseeing data protection.
Regionally, Saudi Arabia’s efforts to build a robust data protection framework position it as a leader in the Middle East’s digital economy. The consultation also supports the growth of a skilled workforce in data protection, creating new career opportunities and enhancing the Kingdom’s attractiveness for international investments that require strong data governance.
Vision 2030 Alignment
This initiative is closely tied to Saudi Arabia’s Vision 2030, which seeks to diversify the economy and promote digital transformation. A sound data protection regime is essential for building trust in digital services, fostering innovation, and attracting global technology companies. By engaging the public in shaping these rules, SDAIA reinforces the Vision’s emphasis on transparency, participation, and sustainable development. As Saudi Arabia continues to advance its digital economy, such consultations will play a vital role in ensuring that regulations keep pace with technological advancements while safeguarding individual rights.
20 Questions
Q1. What is SDAIA?
A1. SDAIA is the Saudi Authority for Data and Artificial Intelligence, established in 2019 to drive national data and AI strategies and oversee data protection regulations.
Q2. What is the Personal Data Protection System?
A2. The Personal Data Protection System is a Saudi law effective from 2023 that regulates the processing of personal data and outlines the rights of data subjects.
Q3. Why is a Personal Data Protection Officer needed?
A3. A DPO ensures that organizations comply with data protection laws, monitors internal procedures, and acts as a contact point for data subjects and regulators.
Q4. Who can provide feedback on the draft rules?
A4. The public and government agencies are invited to submit feedback through the Istitlaa platform.
Q5. What is the Istitlaa platform?
A5. Istitlaa is a public consultation platform affiliated with the National Competitiveness Center that enables stakeholders to contribute to regulatory drafts.
Q6. What is the deadline for submitting feedback?
A6. The deadline for submitting feedback is Tuesday, August 6, 2024.
Q7. What do the draft rules aim to clarify?
A7. The draft rules clarify the circumstances under which a DPO must be appointed and establish minimum requirements for the appointment.
Q8. What are the responsibilities of a DPO?
A8. A DPO oversees the implementation of the PDPS, monitors procedures, handles data requests, and serves as a contact with SDAIA.
Q9. Who is required to appoint a DPO?
A9. Controllers covered by the PDPS must appoint a DPO under certain conditions, as specified in the draft rules.
Q10. How will SDAIA use the feedback?
A10. SDAIA will analyze the feedback and may propose recommendations or adjustments to the draft rules before finalization.
Q11. What is the link to participate in the survey?
A11. The survey can be accessed at: https://istitlaa.ncc.gov.sa/en/Transportation/NDMO/DPORules/Pages/default.aspx#!
Q12. What does PDPS stand for?
A12. PDPS stands for Personal Data Protection System, Saudi Arabia’s data protection law.
Q13. When was SDAIA established?
A13. SDAIA was established in 2019 by royal decree to advance data and AI initiatives in Saudi Arabia.
Q14. What is the role of the National Competitiveness Center?
A14. The National Competitiveness Center operates the Istitlaa platform to facilitate public consultations on government regulations.
Q15. How does this initiative support Vision 2030?
A15. It supports Vision 2030 by promoting transparent governance, digital innovation, and a robust data protection framework that builds trust.
Q16. What happens after the consultation period?
A16. After the consultation, SDAIA will review feedback and finalize the rules, which will then be issued and enforced.
Q17. Can international organizations provide feedback?
A17. The invitation is extended to the public and government agencies; international stakeholders may also participate through the platform.
Q18. What are the benefits of appointing a DPO?
A18. Appointing a DPO helps organizations comply with data protection laws, enhances data governance, and builds trust with customers.
Q19. How does this consultation reflect SDAIA’s approach?
A19. It reflects SDAIA’s commitment to inclusive policymaking by engaging stakeholders and ensuring regulations are practical and effective.
Q20. Where can I find more information about the PDPS?
A20. More information about the PDPS can be found on SDAIA’s official website and through official Saudi government publications.
Reader Feedback
We value your thoughts. Please share your feedback on this article.
Your feedback helps us improve our coverage.