EMME collects the personal information you provide below to provide an individualized response to your completed Self-Assessment. EMME will not share the information provided with anyone and will not use it for any other purpose without first obtaining your express prior approval to do so.

Personal Data Privacy Law Free Self-Assessment

Instructions

The questions contained in this “Personal Data Self-Assessment” are taken from the self-assessment for public and private entities regarding the key requirements of the Personal Data Protection Law of Saudi Arabia, published by the National Data Management Office (NDMO).

The explanations provided under each question were taken from the guidance document also published by the NDMO.

To make this assessment easier to complete, we have separated compound questions into separate questions. We also explain the content of specific articles of the Law and Regulations referenced in the self-assessment questions and guidance.

In order to achieve the full benefit of this Self Assessment, please answer every question.

Processing Principles

1.1a Is personal data collected for specified purposes?

Your organization must determine or define the purposes or reasons of collecting personal data.

Example: An HR department collects the CV of potential candidates for new role. The specific purpose is to screen whether the new candidates are suitable for new roles within the organization.

1.1b Do you collect personal data based on Data Subject Consent?

1.2 Is personal data relevant, limited and minimized to what is necessary in relation to the purposes for which it is processed?

You may not collect more personal data than is needed to achieve the purposes for which the personal data was collected.

1.3 Is Personal Data kept only for as long as it is necessary for the purposes for which it is processed?

Your organization must only process personal data for as long as you need it (i.e., required to fulfill the purposes for which it was collected), unless you are obligated to keep it under the laws that apply to the organization (e.g., specific laws of the sector in which your organization operates).

1.4 Is personal data accurate, complete and kept up to date?

Your organization must regularly review personal data that it holds to ensure that it is accurate, complete, and up to date. You must also provide an opportunity to your customers and employees to review their personal data and update it, where necessary.

Example: A bank has a section on its customer website, where every user can update his personal data.

Privacy Notices and Data Subject Rights

2.1 Are privacy notices clearly provided to data subject informing them of the legal basis for processing and the purpose of processing as well as all other information, as set out in Art. 12 and Art. 13 (including the rights of the data subjects specified in Art.4)?

2.2 Do you have a procedure for a data subject to raise a request regarding his/her rights?

All organizations need to respond to data subject rights. Organizations, therefore, need to have appropriate documentation that specify how such rights must be responded to (e.g., policies, procedures, subject access right request forms, etc.)

2.3 Are data subjects able to access their personal data and request copies of their personal data?

Data subjects must be able to access their personal data and request copies through various channels. For example, via email, phone or through a messaging app on the company’s website.

2.4 Do you maintain processes for correcting, completing or updating personal data for the data subject?

You must have a process in place, whereby you can update or correct the personal data of an individual upon request.

2.5 Where a data subject requests the destruction of personal data, do you take every reasonable step to erase all data, links, action logs (where they identify individuals) and copies subject to any exemption as set out in Art. 18?

If the data subject requests you to delete his/her personal data you must fully delete it from all systems of your organization, including from the archive.

Consent

3.2 Are consent requests clearly distinguishable from other terms and conditions prepared in an intelligible and accessible form, and written in clear and plain language?

In order to collect a consent from a data subject, you must request such consent. Such a request must not be combined with any other terms and conditions – e.g., conditions for sale of products or performance of services.

The request for consent must be presented to the data subject as a separate document which the data subject can easily find and review.

The consent request must be concise and must be written in a language that any person can understand – e.g., without legal education.

3.3 Can data subject at any time withdraw their consent to data processing?

You must provide data subjects with an opportunity to withdraw their consent at any time. The mechanism of such withdrawal must be easy and straightforward for the data subject – not more difficult as it was to give consent in the first place.

Legal Basis Processing

In order to process personal data you need a valid reason to do so. If you have not used consent, you may use any of the following reasons (whichever is suitable).

4.1 Unless you obtained consent as a basis of processing – have you identified any of the below legal basis to proceed personal data:

4.1.1 the processing serves actual interest of the data subject, but communicating with the data subject is impossible or difficult

4.1.2 the processing is performed pursuant to another law or in implementation of a previous agreement to which the data subject is a party

4.1.3 the controller is a public entity and the processing in required for security purposes or to satisfy judicial requirements; or

4.1.4 the processing is necessary for the purpose of legitimate interest of the controller, provided that no sensitive data is processed?

Collecting Personal Data Not Directly from the Data Subject

5.1a Where personal data is not obtained directly from data subjects, do you collect such personal data in accordance with one of the requirements under the Article 10?
Select all that apply:

If you do not obtain personal data directly from the individual, or you change the purpose of processing – you will need to comply with at least one of Article 10 items listed below.

  The Data Subject gives their consent in accordance with the provisions of the Law.
  Personal Data is publicly available or was collected from a publicly available source.
  The Controller is a Public Entity, and the Collection or Processing of the Personal Data is required for public interest or security purposes, or to implement another law, or to fulfill judicial requirements.
  Complying with this may harm the Data Subject or affect their vital interests.
  Personal Data Collection or Processing is necessary to protect public health, public safety, or to protect the life or health of specific individuals.
  Personal Data is not to be recorded or stored in a form that makes it possible to directly or indirectly identify the Data Subject.
  Personal Data collection is necessary to achieve legitimate interests of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed.
  No or Don’t know

5.1b When you want to use personal data for other purposes than for which it was collected, do you comply with at least one of the requirements under Article 10 listed below?
Select all that apply:

Processors

6.1 Do you maintain policies and procedures for contracting and conducting due diligence on processors and sub-processors to ensure they have the necessary guarantees to safeguard the personal data processed?

In order to ensure that the processors you contract with have appropriate controls in place to safeguard the personal data, you will need to ensure that you have conducted sufficient due diligence on them through, for example, a third-party questionnaire to understand what controls and safeguards they have in place for protecting personal data.

Disclosure of Personal Data

7.1 When you disclose personal data, do you do so only in accordance with one of the safeguards under Art. 15 and subject Art. 16?

Before disclosing personal data, you must take the following steps:

Step 1 – You must check that you have applicable grounds to disclose personal data under Article 15.

If not based on consent, Identify the applicable grounds below that you use to disclose personal data under Article 15.

  Personal Data is publicly available or was collected from a publicly available source.
  The Controller is a Public Entity, and the Collection or Processing of the Personal Data is required for public interest or security purposes, or to implement another law, or to fulfill judicial requirements.
  Complying with this may harm the Data Subject or affect their vital interests.
  Personal Data Collection or Processing in necessary to protect public health, public safety, or to protect the life or health of specific individuals.
  Personal Data is not to be recorded or stored in a form that makes it possible to directly or indirectly identify the Data Subject.
  Personal Data collection is necessary to achieve legitimate interests of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed.

Step 2 – If you do not have an applicable ground for disclosure, you then need to check if any of the restrictions of Article 16 apply. If any such restriction apply – YOU MUST NOT DISCLOSE THE PERSONAL DATA.

Identify the restrictions of Article 16 below that may apply?

  Represent a threat to security, harms the reputation of the Kingdom, or conflicts with the interests of the Kingdom.
  Affects the Kingdom’s relations with any other state.
  Prevents the detection of a crime, affects the rights of an accused to a fair trial, or affects the integrity of existing criminal procedures.
  Compromises the safety of an individual.
  Results in violating the privacy of any individual other than the Data Subject, as set out in the Regulations.
  Conflicts with the interests of a person that fully or partially lacks legal capacity.
  Violates legally established professional obligations.
  Involves a violation of an obligation, procedure, or judicial decision.
  Exposes the identity of a confidential source of information in a manner detrimental to the public interest.

7.2 When you correct, complete or update personal data, do you inform other entities to which the personal data has been transferred of such changes?

If you get a subject access request requiring you to update the personal data of an individual, you must ensure that if you shared such personal data with other entities, you request such entities to update this personal data in their systems.

Data Retention

8.1 Do you destroy the personal data that you process once it is no longer necessary for the purpose for which it was collected in accordance with the requirements of Art. 18?

You must only process personal data for as long as you need it, unless you are required to retain it for a legal obligation.

On the expiration of the determined retention period you may retain personal data only in the following cases:

There is another legal basis to keep the personal data.
If the personal data is closely related to a case under consideration before a court and the retention of the personal data is required for that purpose.

Technical and Organizational Measures

9.1 Have you implemented appropriate technical or organizational measures to ensure security of personal data, including its protection during transfer?

An organization needs to have adequate technical and organizational measures to safeguard the personal data. Such controls are required to protect the confidentiality, integrity and availability of the personal data during its transmission and storage.

Breach Notification to Competent Authority

10.1 Do you have a documented procedures (or equivalent) to notify the Competent Authority of a personal data breach?

You should have in place a Data Breach Handling Policy and Procedures in order to respond to personal data breaches. This document must also instruct your organization on when and how you must make notifications to the competent authority and data subjects (where required).

Data Protection Impact Assessments

11.1 Do you have data protection impact assessments (in accordance with Art. 22 of the PSPL) on an ongoing basis?

You must assess data privacy risks (risks of violating the PDPL) in relation to every product and a service that you plan to offer to the public.

Processing of Health Data

12.1 Do you process Health Data?

Processing of Credit Data

13.1 Do you process Credit Data?

Advertising and Awareness Materials

14.1 Do you use personal means of communication (such as post and/or email) for advertising and/or awareness?

Such communication includes sending emails, text messages, push-notifications, etc. to inform the data subject of some commercial, marketing or other information.

14.2 Do you conduct such advertising and/or awareness in accordance with the requirements of Art. 25 of the PDPL?

Processing Personal Data for Marketing Purposes

15.1 If you process personal data for marketing purposes, do you collect consent for such marketing and do you ensure that no sensitive data is collected for such marketing purposes?

15.2 When collecting consent for marketing purposes is such collection of consent in accordance with the PDPL?

Identify the all steps below taken to comply with the PDPL.

  We record and store all consents in our organization’s systems.
  We request consent separately and not combined with any other terms and conditions.
  We present and request consent in a separate document that the data subject can easily find and review.
  The consent request is concise and written in a language that any person can understand – e.g., without legal education.
  We provide data subjects with a mechanism to withdraw their consent at any time that is easy and straightforward for the data subject – not more difficult than it was to give consent in the first place.

Processing Personal Data for Scientific, Research, or Statistical Purposes

16.1a Do you process personal data for scientific, research, or statistical purposes?

You may process personal data for such purposes without the consent of the data subject in the following cases:

such data does not specifically identify the data subject (e.g., the data is anonymized).
the evidence of the data subject’s identity will be destroyed during the processing and prior to disclosure of such data to any other entity, if it is not sensitive data.
if personal data collected or processed for these purposes is required by another law or in implementation of a previous agreement in which the data subject is a party.

16.1b If you process personal data for scientific, research, or statistical purposes, do you comply with Article 27.

Identify all steps below taken to comply with the Article 27.

  We do not use Sensitive personal data for scientific, research, or statistical purposes.
  We anonymize all data used for scientific, research, or statistical purposes.
  Scientific, research, or statistical processing is required by another law or in implementation of a previous agreement in which the data subject is a party.

Official Documents

17.1a Do you process official documents?

17.1b If so, do you restrict the copying of official documents to the cases as set out in Article 28 of the PDPL?

Identify all steps taken to copy official documents in compliance with the Article 28.

were required to do so by law.
when a public authority asks us to copy such documents.

Data Transfers Outside the Kingdom

18.1 Do you transfer, store or process personal data outside Saudi Arabia?

Any use of personal data which assumes transfer outside the borders of Saudi Arabia means processing outside Saudi Arabia (e.g., storage of personal data in cloud storage systems hosted outside Saudi Arabia).

Records of Processing

19.1 Have your created and maintained a record of how you process personal data in accordance with the requirements of Art. 31.

Records of Processing is a document which describes how the personal data is processed across your organization.

Accountability and Governance

20.1 Do you have a governance and operating model for data protection within your organization?

Accountability and Governance is clear and structured description of the data privacy function within your organization. It must show how various employees and divisions in your organization cooperate with each other on various data privacy issues.

20.2 Do you train all employees that handle personal data on PDPL requirement – including on processing activities, controls, privacy impact assessments, audits, data subject rights, reporting lines and privacy by design and on the potential impact of non-compliance?

Your employees that deal with personal data (e.g. IT department, HR department, etc.) must undergo regular training on data privacy.
Data privacy training may include, for instance, introduction to:

data privacy concepts,
data privacy function and practices of your organization.

20.3 Do you have an appointed Data Protection Officer (DPO)? Does he/she have reporting authority to the highest level of management, necessary resources, independence, and authority to ensure compliance with the PDPL?

Data Privacy Offer is the main person in your organization who is responsible for data privacy issues. He must have reporting authority to the highest level of management, necessary resources, independence, and authority to ensure compliance with the PDPL.

20.4 Do you have a single approach (e.g., rules and standards) in relation to processing and storage of personal data across your organization (including all of it subsidiaries, where applicable)?

A single approach means that your organization has common standards and requirements that apply to all personal data processed across all your organization (including it branches). Such standards and requirements must be specified in a policy, procedure or other internal documents of your organization.

20.5 Do you occasionally carry out random checks of your organization to check its compliance with PDPL?

From time to time you must arrange in your organization assessments in order to understand whether or not your organization complies with the PDPL. Such assessments may be conducted by your personnel (e.g. Data Privacy Officer, internal audit) or by an external organization.