SDAIA Seeks Public Feedback on Data Transfer Terms

The Saudi Data and Artificial Intelligence Authority (SDAIA) has invited the public and relevant stakeholders to provide feedback on the standard contractual terms for the transfer of personal data, as announced on August 17, 2024. The consultation is being conducted through the unified electronic platform Istitlaa, managed by the National Competitiveness Center, and will remain open until August 30, 2024. This initiative reflects SDAIA’s commitment to ensuring that personal data transferred outside the Kingdom receives protection that meets or exceeds the standards set by the Personal Data Protection Law (PDPL) and its executive regulations.

Context and Background

SDAIA, established in 2019, is the national authority responsible for data and artificial intelligence in Saudi Arabia. It oversees the implementation of the PDPL, which was enacted to safeguard personal data and promote a robust data governance framework. The PDPL requires that personal data transferred outside Saudi Arabia only be sent to jurisdictions or international organizations that provide an adequate level of protection, as determined by SDAIA. For transfers to entities not on the adequacy list, standard contractual clauses (SCCs) serve as a legal mechanism to ensure compliance. The current public consultation aims to refine these SCCs, ensuring they are practical, legally sound, and aligned with international best practices.

Key Details

The draft standard contractual terms are designed for contracts and agreements involving the transfer of personal data to countries or international organizations not recognized as having adequate protection levels. Stakeholders can review the draft and submit their feedback via the Istitlaa platform at the following link: https://istitlaa.ncc.gov.sa/ar/Transportation/NDMO/SCC/Pages/default.aspx#. The feedback period closes on August 30, 2024. This public consultation is part of SDAIA’s ongoing efforts to engage with the community and ensure that data protection regulations are transparent and inclusive. By involving stakeholders, SDAIA aims to create a balanced framework that facilitates data flows while upholding privacy rights.

Implications and Impact

The introduction of standard contractual terms is expected to have significant implications for businesses operating in Saudi Arabia and their international partners. It provides a clear legal pathway for cross-border data transfers, reducing uncertainty and compliance risks. This move aligns with global trends, such as the European Union’s Standard Contractual Clauses, and positions Saudi Arabia as a leader in data protection in the region. For international companies, adhering to these terms will facilitate smoother data exchanges, enhancing trade and cooperation. Moreover, it demonstrates Saudi Arabia’s commitment to protecting individual privacy, which is essential for building trust in the digital economy.

Vision 2030 Alignment

This initiative is closely tied to Saudi Vision 2030, which seeks to diversify the economy and establish the Kingdom as a global hub for technology and innovation. A robust data protection framework is critical for attracting foreign investment, fostering digital entrepreneurship, and enabling emerging technologies like artificial intelligence and cloud computing. By ensuring high standards for personal data protection, SDAIA supports the creation of a secure digital environment that encourages innovation and economic growth. This consultation reflects the Kingdom’s proactive approach to governance in the digital age, reinforcing its position as a responsible global player.

20 Questions

Q1. What is the purpose of the public consultation announced by SDAIA?

A1. SDAIA invites feedback on standard contractual terms for transferring personal data outside Saudi Arabia to ensure protection levels meet or exceed the Personal Data Protection Law standards. The consultation aims to refine these terms for practical and legal robustness.

Q2. What is the deadline for submitting feedback?

A2. The feedback period is open until August 30, 2024. Stakeholders can submit their comments through the Istitlaa platform before this deadline.

Q3. Which platform is used for the consultation?

A3. The consultation is hosted on the Istitlaa platform, managed by the National Competitiveness Center. It provides a unified electronic space for public participation in regulatory affairs.

Q4. What are standard contractual terms for personal data transfer?

A4. These are predefined clauses in contracts that govern the transfer of personal data to countries without adequate protection levels. They ensure compliance with the Personal Data Protection Law and safeguard privacy.

Q5. Why is SDAIA focusing on cross-border data transfers?

A5. Cross-border data transfers are essential for global business and digital services. SDAIA aims to facilitate these transfers while ensuring that personal data receives adequate protection abroad, in line with the PDPL.

Q6. What is the Personal Data Protection Law?

A6. The PDPL is Saudi Arabia’s comprehensive data protection law, enacted to regulate the collection, processing, and transfer of personal data. It sets standards for privacy and data security, enforced by SDAIA.

Q7. What happens if a country is not on the adequacy list?

A7. For countries not recognized as providing adequate protection, transfers require additional safeguards such as standard contractual clauses. These clauses legally bind parties to uphold PDPL standards.

Q8. How does this initiative benefit businesses?

A8. It provides legal certainty and a clear framework for cross-border data transfers, reducing compliance risks. Businesses can operate more efficiently while ensuring data protection, which builds trust with customers and partners.

Q9. Is this consultation open to the general public?

A9. Yes, SDAIA invites the public and relevant stakeholders to participate. This inclusive approach ensures diverse perspectives are considered in shaping the regulations.

Q10. What is the role of the National Competitiveness Center?

A10. The National Competitiveness Center manages the Istitlaa platform, which facilitates public consultations on government regulations. It supports transparency and stakeholder engagement in policymaking.

Q11. How does this align with Saudi Vision 2030?

A11. Vision 2030 aims to diversify the economy and promote digital innovation. Robust data protection frameworks attract investment and enable technologies like AI, supporting the Kingdom’s transformation into a digital hub.

Q12. What are the consequences of non-compliance with the PDPL?

A12. Non-compliance can lead to penalties, including fines, as stipulated by the PDPL. SDAIA oversees enforcement to ensure organizations adhere to data protection standards.

Q13. Will the feedback be publicly available?

A13. SDAIA may publish a summary of the feedback and how it was addressed, in line with transparency practices. However, specific comments may remain confidential.

Q14. How do standard contractual terms compare internationally?

A14. They are similar to the EU’s Standard Contractual Clauses, which are widely used for cross-border data transfers. Saudi Arabia’s approach aligns with global best practices, facilitating international data flows.

Q15. What types of data are covered by these terms?

A15. The terms cover all personal data as defined by the PDPL, which includes any information relating to an identifiable individual. This ensures comprehensive protection.

Q16. Can individuals submit feedback, or only organizations?

A16. Both individuals and organizations are encouraged to submit feedback. SDAIA values input from all stakeholders to create effective and balanced regulations.

Q17. What is the expected timeline for implementing the standard contractual terms?

A17. After the consultation period, SDAIA will review the feedback and finalize the terms. Implementation timelines will be announced subsequently, likely in late 2024.

Q18. How does this initiative affect international data transfers for Saudi companies?

A18. Saudi companies transferring data abroad will need to incorporate these standard contractual terms into their agreements, ensuring compliance and enabling seamless international operations.

Q19. Are there any exceptions to using standard contractual terms?

A19. Exceptions may apply for transfers to countries with adequate protection or under specific derogations outlined in the PDPL. The consultation aims to clarify such exceptions.

Q20. Where can I find more information about the PDPL?

A20. More information is available on SDAIA’s official website and through the Istitlaa platform. The PDPL and its executive regulations are publicly accessible, providing detailed guidance.

---