SDAIA announces ‘postponement of full enforcement’ of Saudi Personal Data Protection Law… but what does that really mean?

There is considerable ambiguity around SDAIA’s announcement on 22 March 2022 that:

due to input received during the public consultation on the draft Implementing Regulations to the Personal Data Protection Law, and in order to achieve the ultimate goal of such law, the competent authorities have decided to postpone the full enforcement of the Personal Data Protection Law until 17 March 2023 to take the necessary measures in light of these recommendations.

The Personal Data Protection Law (“PDPL”), contemplates the Implementing Regulations being issued by 23 March 2022 – i.e. within 180 days of the PDPL being officially published in the official gazette. Despite this, the Implementing Regulations were only issued in draft for public consultation on 10 March 2022, with the consultation period ending on 25 March 2022 according to the original announcement about the consultation. So, clearly, the Implementing Regulations are ‘late’, relative to what was contemplated when the PDPL was passed.

In terms of the proposed ‘new’ date of 17 March 2023, if we are to understand this in accordance with the PDPL, then this date could be understood as the end of the contemplated grace period of up to 12 months from the law coming into effect on 23 March 2022. In other words, SDAIA’s announcement relating to postponing full enforcement to 17 March 2023 can be understood as consistent with the grace period approach as contemplated in the PDPL.

• If the Implementing Regulations are finalised and published shortly, allowing those subject to the PDPL time to put their personal data processing operations in order prior to 17 March 2023, then those subject to the law can prepare accordingly. This will be challenging, but potentially workable.
• If the Implementing Regulations are not finalised promptly, then the window of time remaining in the grace period will shrink, making it difficult for those subject to the PDPL to put their personal data processing operations in order prior to the end of the grace period. This is not an ideal scenario, as it will be more difficult for those subject to the PDPL to comply in time.

An alternative interpretation of SDAIA’s announcement is that the date of 17 March 2023 has become a new ‘effective date’ from which the PDPL should be understood as coming into effect, and the grace period of 12 months (as contemplated in the law) accordingly starts from 17 March 2023.  While this interpretation sounds convenient (as it will push the timeline for compliance further into 2023/2024), it would seem more consistent with the PDPL to understand 23 March 2022 as the date on which the law has come into force, and thus the grace period has already commenced, to end – as announced by SDAIA – on 17 March 2023.

Obviously, it would be good to have clarity in terms of whether the grace period contemplated in the PDPL ends, or begins, on 17 March 2023.  If the grace period ends on that date, it would be good to have the Implementing Regulations published as soon as possible, so that necessary steps can be taken to ensure compliance with the requirements.

Of course, the over-arching consideration, of ensuring that suitable Implementing Regulations are ultimately issued, is a good reason to slow things down a bit. SDAIA seems to be acting prudently in taking this approach.

How we can help

As a leading law firm in the Middle East & North Africa Region and with a reputable and dedicated Digital & Data practice, Al Tamimi & Company is well placed to assist you with assessing the probable impact of the PDPL and its implementing regulations on your organisation.

If you would like to further discuss the contents of this alert, please contact our Saudi Arabia team.