Regulation on Personal Data Transfer Outside the Kingdom Article 2 lists three specific, additional purposes under which personal data may be transferred or disclosed to entities outside the Kingdom of Saudi Arabia, provided these fall within the exception described in Article 29(1)(d) of the PDPL. These cases represent practical, often operational, justifications where international transfer is necessary to serve the controller’s legitimate functions or provide benefit to the data subject.
Regulation on Personal Data Transfer Outside the Kingdom Article 2
Other Purposes for Cross-Border Transfer
Other purposes for transferring or disclosing personal data to a party outside the
Kingdom shall comply with subparagraph (d) of paragraph (1) of Article (29) of the Law, including:
Central Processing
1. Performing necessary operations for central processing to enable the
controller to conduct its activities.
Benefit to Data Subject
2. To provide a service or benefit to the subject of the personal data.
Scientific Research
3. Conducting scientific research and studies.
Explanation of Regulation on Personal Data Transfer Outside the Kingdom Article 2
Operational necessity:
Regulation on Personal Data Transfer Outside the Kingdom Article 2 permits data transfer when essential for centralized IT, HR, finance, or other processing needed for the controller to function across jurisdictions.
Individual service delivery:
Regulation on Personal Data Transfer Outside the Kingdom Article 2 allows transfer if it provides a direct benefit to the data subject, such as service delivery, customer support, or product fulfilment.
Public or academic value:
Regulation on Personal Data Transfer Outside the Kingdom Article 2 enables transfer to support legitimate academic or research activity—likely subject to safeguards to protect data subject rights.
