PDPL Article 4 lists the core rights that every Data Subject (the person the data is about) has under the PDPL. These rights must be respected by the Controller (the entity that decides how and why to process the data): right to be informed, access, get a copy, correct, and delete when no longer needed.
Data Subject shall have the following rights pursuant to this Law and as set out in the Regulations:
Saudi PDPL Article 4 (1)
Right to Be Informed
The right to be informed about the legal basis and the purpose of the Collection of their Personal Data.
Saudi PDPL Article 4 (2)
Right to Access
The right to access their Personal Data held by the Controller, in accordance with the rules and procedures set out in the Regulations, and without prejudice to the provisions of Article (9) of this Law.
Saudi PDPL Article 4 (3)
Right to Request a Copy
The right to request obtaining their Personal Data held by the Controller in a readable and clear format, in accordance with the controls and procedures specified by the Regulations.
Saudi PDPL Article 4 (4)
Right to Correct
The right to request correcting, completing, or updating their Personal Data held by the Controller.
Saudi PDPL Article 4 (5)
Right to Request Destruction
The right to request a Destruction of their Personal Data held by the Controller when such Personal Data is no longer needed by Data Subject, without prejudice to the provisions of Article (18) of this Law.
Explanation of Saudi PDPL Article 4
Know Why Your Personal Data is Collected:
Saudi PDPL Article 4 (1) says that, individuals have the right to know why their personal data is being collected and the legal basis for doing so (e.g., consent, legitimate interest, legal obligation).
See What Personal Data is Held:
Saudi PDPL Article 4 (2) says that, individuals can request to see their personal data held by a controller, following the process and rules defined in the Regulations. (Subject to exceptions in Article 9, which covers access restrictions.)
Get Your Personal Data Copy:
Saudi PDPL Article 4 (3) says that, individuals can ask for a copy of their data in a format that is clear and readable (e.g., digital file), as per the conditions in the Regulations.
Update Your Personal Data:
Saudi PDPL Article 4 (4) says that, individuals can request that their personal data be corrected, completed, or updated if it’s inaccurate or incomplete.
Ask to Delete Your Data:
Saudi PDPL Article 4 (5) says that, individuals can request their data to be deleted (called Destruction in PDPL) when they no longer need the service or product unless another law (e.g., Article 18) requires the data to be kept.
