Material Applicability

The KSA PDPL's material scope is defined by two key exemptions:

• Personal and Domestic Use Exemption
• Deceased Individuals Exemption

Personal and Domestic Use Exemption

KSA PDPL Article 2(2):

"The scope of applying the Law excludes the individual's Personal Data Processing for purposes that do not go beyond personal or family use, as long as the Data Subject did not publish or disclose it to others. The Regulations shall define personal and family use provided in this Paragraph."

This exemption applies when:

• Processing is conducted for strictly personal or family purposes
• The data subject has not published or disclosed the data to others
• The processing does not extend beyond private use

Deceased Individuals Exemption

KSA PDPL Article 2(1):

"The Law applies to any Processing of Personal Data related to individuals that takes place in the Kingdom by any means, including the Processing of Personal Data related to individuals residing in the Kingdom by any means from any party outside the Kingdom. This includes the data of the deceased if it would lead to them or a member of their family being identified specifically."

The law explicitly extends protection to deceased individuals' data when:

• The data can identify the deceased person
• The data can identify members of the deceased person's family

Territorial Applicability

The KSA PDPL's territorial scope is determined by:

• Processing location
• Data subject residence

KSA PDPL Article 2(1):

"The Law applies to any Processing of Personal Data related to individuals that takes place in the Kingdom by any means, including the Processing of Personal Data related to individuals residing in the Kingdom by any means from any party outside the Kingdom."

The law applies to:

• Any processing of personal data occurring within Saudi Arabia
• Processing of Saudi residents' personal data by entities outside the Kingdom