Personal Data Protection Law — transfer of personal data outside the Kingdom

Art. 29 permits transfer or disclosure outside the Kingdom only for defined purposes — performing an obligation under an agreement to which Saudi Arabia is a party, serving the Kingdom's interests, performing an obligation to which the data subject is a party, or other purposes set out in the Regulations — and subjects every transfer to two overriding limits: it must not prejudice national security or the Kingdom's vital interests, and it must be confined to the minimum personal data necessary. The separate Data Transfer Regulation supplies the mechanics, including the risk-assessment requirement and the appropriate-safeguard routes (standard contractual clauses and binding common rules). Marked 'check': the transfer regulation has been amended since issue, the operative texts are Arabic-language originals, and SDAIA's supervisory role is expected to move to a dedicated authority.