Saudi Personal Data Protection Law (PDPL): Data Leak Complaints

You get a marketing message from a clinic you have never visited. It has your full name and the type of treatment you had at another hospital. Or you learn that an employee of an instalment-finance company is sharing customers' ID copies and contracts in a WhatsApp group. Who do you complain to, and is there a real penalty?

The direct answer: yes. The Personal Data Protection Law (PDPL) gives you the right to complain to the competent authority that supervises it (Article 34). That authority is the Saudi Data and Artificial Intelligence Authority (SDAIA), under the Council of Ministers decision issued with the law. The deadline is 90 days from the incident or from when you learned of it (Article 37 of the Implementing Regulation). Violations by private entities and individuals go to a committee formed by SDAIA, which can issue a warning or a fine of up to SAR 5 million (Article 36). Disclosing or publishing sensitive data to harm someone or for personal benefit is a crime investigated by the Public Prosecution and tried in court (Article 35). Your compensation is claimed before the competent court (Article 40).

Which violations can you report to SDAIA?

• Collecting or using your data without a legal basis, or for a purpose other than the one it was collected for.
• Disclosing your data to another party without your consent or a legal basis.
• Ignoring your request to access, correct or destroy your data: the controller must act within 30 days, extendable by another 30 days if it tells you in advance with reasons (Article 4 of the law, Article 3 of the Regulation).
• A data leak without notice: the controller must notify SDAIA within 72 hours of learning of a leak that may harm you, and notify you without undue delay (Article 20 of the law, Article 24 of the Regulation).
• Direct marketing without your consent, or without an easy, free way to stop it (Article 29 of the Regulation).

The law does not apply to an individual processing data for purely personal or family use, such as a list of relatives' numbers. That exception ends if the person publishes the data to the public, discloses it outside their limited circle, or uses it for professional or commercial purposes (Article 2 of the law and Article 2 of the Regulation).

Who has jurisdiction: the committee, the prosecution, the employer or the court?

The committee has at least three members, including a technical specialist and a legal adviser, and its decision is approved by the head of the competent authority or his delegate (Article 36 as amended by Royal Decree M/148 of 1444H). The committee or the court may order a summary of the decision to be published at the violator's cost once it is final (Article 38).

The Council of Ministers decision made SDAIA the competent authority for two years, during which a transfer of supervision to the National Data Management Office was to be considered. SDAIA is the body that receives complaints today, through its National Data Governance Platform.

What is "sensitive data", and why does it matter?

After the 1444H amendment, sensitive data means data about racial or ethnic origin, religious, intellectual or political belief, security and criminal data, biometric data that identifies a person, genetic data, health data, and data showing that a person's parents or one of them are unknown (Article 1). Disclosing this data to harm someone or for benefit is what turns a case into a criminal one. Credit data was removed from the sensitive-data definition by the amendment, but the Regulation still imposes special protection and requires your consent and notice before it is disclosed (Article 27 of the Regulation).

How do you file a complaint, and what do you attach?

It helps to first ask the entity in writing where it got your data and how it used it; its reply, or its silence, becomes evidence. Then complain to SDAIA within 90 days. SDAIA may accept a late complaint if real reasons prevented you from filing on time (Article 37(1) of the Regulation). The complaint must include (Article 37(4)):

• Where and when the violation happened.
• Your name, ID, address and phone number.
• Details of the entity you complain about.
• A clear and specific description of the act, with evidence: screenshots of messages showing the sender number and date, the entity's replies, and the names of people who received your data.

SDAIA examines the complaint, may ask you for more documents, and informs you of the result (Article 37(5) and (6) of the Regulation). If the leak was deliberate, aimed at harming you and involves sensitive data, also file a criminal report so that it reaches the Public Prosecution.

A violations committee decision was issued against your business: what now?

A party against whom the committee issues a decision may challenge it before the competent court (Article 36(3)). The PDPL sets no specific period for this, so do not rely on that to delay. Count the general periods of the Law of Procedure before the Board of Grievances from the date you learned of the decision: a grievance to the issuing authority within 60 days, then a lawsuit within 60 days of rejection or of 60 days passing without a reply (Article 8). Also read the notification itself, which may set out the grievance route. In urgent cases you may seek annulment together with a stay of the decision during the grievance period (Article 8(5)).

A customer of an instalment-finance company learned on 3 March, from a friend, that her ID copy and contract were being shared in a group on a messaging app.

She asked the company in writing for an explanation and got no reply within 30 days. She complained to SDAIA before 90 days had passed from when she learned of it, attaching screenshots of the group and her request to the company.

The company faces a fine of up to SAR 5 million if a breach of its duty to protect data is proven. The customer may also sue for compensation for her material and moral harm (Article 40).

Practical solutions for both sides

If you are the data subject:

• Screenshot the messages or posts with the date and sender number before they are deleted.
• Ask the entity in writing about the source of your data and to stop using it, and keep the request.
• Count 90 days from the day you learned of the incident; do not wait for a reply that never comes.
• If health, criminal or similar data was published to harm you, add a criminal report.
• Document the effect on you, such as fraud, social embarrassment or lost work, for a compensation claim.

If you run a business that processes customer data:

• Adopt a written procedure to answer data subject requests within 30 days.
• Prepare a breach plan that ensures notice to SDAIA within 72 hours and notice to affected people.
• Limit staff access to IDs and contracts, and keep an access log.
• Record customer consent before any marketing messages, and offer one-click opt-out.
• If you receive a committee decision, start counting grievance periods from the day you learned of it.

If your data has been leaked or your business received a violation notice, send us what you have on WhatsApp and we will help you prepare the complaint or the response before the deadline passes.

This is general information based on the official Arabic texts of Saudi laws, which prevail over any translation. It is not legal advice for your specific case.