Overview
PDPL Implementing Regulation Article 22 sets the obligations on Controllers when correcting, completing, or updating Personal Data. The Article defines the types of corrections covered, establishes procedures to ensure accuracy and integrity, and requires communication with affected parties. It also mandates suspension of Processing when inaccurate or incomplete Personal Data may cause harm, and requires Controllers to implement organizational and technical measures to prevent risks arising from outdated or incorrect data.
These rules ensure that corrections are timely, documented, and fully aligned with the Data Subject’s right (DSR) to accurate Personal Data under PDPL Article 17.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 22: Correction of Personal Data
- The types of correction of Personal Data referred to in paragraph (2) of Article 17 of the Law include correcting data that is incorrect, completing data that is incomplete, or updating data that is outdated.
- When correcting Personal Data, the Controller shall comply with the following:
- Ensure the accuracy and integrity of Personal Data by examining and reviewing supporting documents if necessary.
- Notify the parties to whom the Personal Data has been disclosed previously without delay.
- Notify the Data Subject when the correction is completed.
- Document all updates made to Personal Data.
- If the Controller identifies that Personal Data is inaccurate or incomplete, and that may cause harm to the Data Subject, the Controller shall suspend Processing until the data is updated or corrected.
- In accordance with paragraph (2) of this Article, when the Controller becomes aware that Personal Data is inaccurate, outdated, or incomplete, the Controller shall take the necessary steps to correct, complete, or update it using the available means without delay.
- The Controller shall take appropriate organizational, administrative and technical measures to avoid the impact of Processing inaccurate, incomplete, or outdated Personal Data, including:
- Develop and update internal policies and procedures in accordance with the provisions of the Law and this Regulation, including procedures that enable Data Subjects to exercise their right to request correction in accordance with the provisions of the Law and this Regulation.
- Periodic review of the accuracy and timeliness of Personal Data.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
