KSA PDPL » Saudi PDPL Article 27 – Research and Statistical Data Use

Saudi PDPL Article 27 – Research and Statistical Data Use

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 10, 2025
Updated: January 10, 2026

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 27 explains when personal data may be processed for scientific, research, or statistical purposes without requiring the Data Subject’s consent. The Article allows these activities only when the data does not identify the individual, when any identifying elements are destroyed before disclosure to others, or when processing is required by another law or pre-existing contractual obligation.

Article 27 enables legitimate research while ensuring strict controls that protect privacy, prevent re-identification, and maintain compliance with the Personal Data Protection Law. The Implementing Regulations will provide additional security and technical requirements to ensure research-based processing remains lawful, ethical, and aligned with SDAIA standards.

SDAIA's Official PDPL Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 27

Personal data may be collected or processed for scientific, research, or statistical purposes without the consent of the Data Subject in the following situations:

If it does not specifically identify the Data Subject.

If evidence of the Data Subject’s identity will be destroyed during the Processing and prior to Disclosure of such data to any other entity, if it is not Sensitive Data.

If personal data is collected or processed for these purposes is required by another law or in implementation of a previous agreement to which the Data Subject is a party.

The Regulations shall set out the controls required by the provisions of this Article.

Plain-Language PDPL Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

PDPL Article 27(1)

Non-Identifiable Data

This provision allows processing when the personal data does not identify the Data Subject. This means research or statistical work may proceed only if the data cannot reveal the individual directly or indirectly. If no identifying attribute exists, consent is unnecessary because the data no longer relates to an identifiable person under PDPL.

This ensures that research can occur while protecting individual privacy.

PDPL Article 27(2)

Identity Destroyed Early

Non-Sensitive Requirement This form of processing is permitted only when the data is not Sensitive Data. Even if identity is destroyed, personal data classified as Sensitive Data requires heightened protection and cannot be processed under this exemptions. The purpose of this clause is to prevent research-based access to data categories with elevated privacy risks, maintaining stricter PDPL safeguards.

Non-Sensitive Requirement

This form of processing is permitted only when the data is not Sensitive Data. Even if identity is destroyed, personal data classified as Sensitive Data requires heightened protection and cannot be processed under these exemptions.

The purpose of this clause is to prevent research-based access to data categories with elevated privacy risks, maintaining stricter PDPL safeguards.

PDPL Article 27(3)

Processing Mandated Elsewhere

This provision clarifies that consent is not required when processing is mandated by another law or when it is carried out under a previous contractual or legal agreement to which the Data Subject is already a party. This ensures lawful continuity of research obligations such as academic mandates, sectoral reporting, or pre-existing commitments.

Processing must remain strictly within the defined legal or contractual scope.

Frequently Asked Questions (FAQs)

Only if the research use meets the conditions in Article 27. The use must not harm Data Subjects and must follow the rules set by the Regulation.

What is the difference between “research use” and “statistical use” under Article 27?

Research use typically aims to study trends or develop insights, while statistical use focuses on aggregated data analysis. Article 27 applies special conditions to both, especially when Personal Data is involved.

If we anonymize data before using it for analytics, does Article 27 still apply?

If the data is truly anonymized and cannot be linked back to a person, Article 27 generally does not apply. If any re identification is possible, PDPL rules remain in effect.

In healthcare, can hospitals use patient data for medical research under Article 27?

Yes, if the research meets Article 27 conditions and does not harm the patient. The legal basis must still align with PDPL requirements.

Can a company use customer data for internal product research without treating it as marketing?

Yes, research is distinct from marketing, but Article 27 still applies when Personal Data is used. The purpose must genuinely be research, not disguised promotional activity.

In e commerce, can we use purchase history to create broad statistical reports?

Yes, if the analysis does not identify individuals or create harm. Article 27 allows statistical use under controlled conditions.

Who determines whether a particular research activity complies with Article 27, the Controller or the Processor?

The Controller makes that determination. A Processor cannot decide research purposes on its own.

Only if the research meets Article 27 conditions and PDPL requirements. Sharing must not harm individuals and must be supported by an appropriate legal basis.

In fintech, does using transaction data to detect national economic trends fall under Article 27?

It can, if the data is used for statistical analysis rather than individual profiling. The use must still comply with PDPL conditions.

Does Article 27 allow long term retention of Personal Data for future research?

Only if the retention aligns with PDPL retention rules. Research does not justify storing data longer than necessary.

Common misconception, “Research exemptions allow full access to Personal Data.” Is that true under KSA PDPL?

No, Article 27 does not grant unrestricted access. Research use must be controlled, limited, and non harmful.

Can a SaaS provider use client data to conduct research for improving its own platform?

Only if permitted by the Controller and aligned with Article 27. A Processor cannot independently repurpose Personal Data for research.

Saudi Personal Data Protection Law Compliance Services (KSA PDPL)

KSA PDPL Compliance Implementation

Achieve PDPL Compliance in 4 weeks or less.

Data Protection Officer As A Service (DPOaaS)

Let us handle your daily PDPL Compliance Operations.

KSA PDPL Compliance Audit (External)

Audit your PDPL compliance obligations.

Table of Contents

← PDPL Compliance Ecosystem