This month we have a packed Law Update focusing on a sector that is a vital pillar for the region as it continues to push its economies to diversify. Education.
The Education sector has experienced, and overcome, its fair share of challenges. Today, across the region, it serves as an educational hub for nationals, residents, and a growing number of inbound international students.
The advances being made in the Education Sector are a result of Government initiatives being put in place to propel the sector to a global standard. This has piqued private sector interest and we are seeing more public private and international partnerships.
With Education being vital to the progress the region is making, we have a created an edition of Law Update that provides insights, commentary, and updates on the most pertinent developments within the sector. The articles come from a number of jurisdictions across the region and highlight key considerations and the latest legal trends taking shape.Read the full edition
There is considerable ambiguity around SDAIA’s announcement on 22 March 2022 that:
The Personal Data Protection Law (“PDPL”), contemplates the Implementing Regulations being issued by 23 March 2022 – i.e. within 180 days of the PDPL being officially published in the official gazette. Despite this, the Implementing Regulations were only issued in draft for public consultation on 10 March 2022, with the consultation period ending on 25 March 2022 according to the original announcement about the consultation. So, clearly, the Implementing Regulations are ‘late’, relative to what was contemplated when the PDPL was passed.
In terms of the proposed ‘new’ date of 17 March 2023, if we are to understand this in accordance with the PDPL, then this date could be understood as the end of the contemplated grace period of up to 12 months from the law coming into effect on 23 March 2022. In other words, SDAIA’s announcement relating to postponing full enforcement to 17 March 2023 can be understood as consistent with the grace period approach as contemplated in the PDPL.
An alternative interpretation of SDAIA’s announcement is that the date of 17 March 2023 has become a new ‘effective date’ from which the PDPL should be understood as coming into effect, and the grace period of 12 months (as contemplated in the law) accordingly starts from 17 March 2023. While this interpretation sounds convenient (as it will push the timeline for compliance further into 2023/2024), it would seem more consistent with the PDPL to understand 23 March 2022 as the date on which the law has come into force, and thus the grace period has already commenced, to end – as announced by SDAIA – on 17 March 2023.
Obviously, it would be good to have clarity in terms of whether the grace period contemplated in the PDPL ends, or begins, on 17 March 2023. If the grace period ends on that date, it would be good to have the Implementing Regulations published as soon as possible, so that necessary steps can be taken to ensure compliance with the requirements.
Of course, the over-arching consideration, of ensuring that suitable Implementing Regulations are ultimately issued, is a good reason to slow things down a bit. SDAIA seems to be acting prudently in taking this approach.
As a leading law firm in the Middle East & North Africa Region and with a reputable and dedicated Digital & Data practice, Al Tamimi & Company is well placed to assist you with assessing the probable impact of the PDPL and its implementing regulations on your organisation.
If you would like to further discuss the contents of this alert, please contact our Saudi Arabia team.