Overview
Elaboration and Developing Privacy Policy Guideline — Tenth: Availing and Providing Access to Privacy Policy explains the obligation of the Controller to make the Privacy Policy accessible to Data Subjects in a clear and understandable manner.
It clarifies how individuals must be notified of the Privacy Policy, the acceptable methods for presenting and designing it, and the requirement to periodically review and document updates to the Privacy Policy.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Tenth: Availing and Providing Access to Privacy Policy
The Controller shall provide access to the Privacy Policy and ensure that its content is written in clear, non-misleading, easy-to-read, and understandable language suitable for the comprehension level of all categories of Data Subjects. In addition, the necessary measures shall be taken to notify individuals of the Privacy Policy, as privacy notification is one of the primary ways to inform individuals about the collection of their data. This can be done through app notifications, SMS, e-mails, or a standalone form provided to Data Subjects before or during the collection and processing of their Personal Data.
The Controller shall periodically review the Privacy Policy and record any amendment or update introduced thereto in the update record stated in the Clause (Second) herein above.
In addition, any of the following methods can be followed.
- Adding pictures and icons that express the content of clauses and paragraphs in a manner that facilitates the reader's quick understanding of the content.
- Reordering and titling clauses and paragraphs in a logical manner that stimulates rapid reading and comprehensing.
- The Privacy Policy shall be designed in a clear and understandable manner for specific groups if the entity aims, in full or in part, to process data of such special segments (children, elderly, persons with disabilities).
- The Privacy Policy shall be designed in a language suitable for the target audience.
- Adding other related links to the Privacy Policy, such as Terms & Conditions, Cookie Policy, and Personal Data Protection Law.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
