Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 28 establishes clear restrictions on copying official documents that can identify an individual. Copies of passports, national IDs, and similar documents may not be made unless a specific law requires it or a competent public authority formally instructs the controller to copy such materials.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 28
It is not permissible to copy official documents where Data Subjects are identifiable, except where it is required by law, or when a competent public authority requests copying such documents pursuant to the Regulations.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Copying Requires Legal Basis
Article 28 states that a controller is not permitted to copy official documents that make a Data Subject identifiable unless a specific legal requirement applies. Copying is only allowed when a law mandates it or when a competent public authority issues a formal request in accordance with the Regulations. This ensures that sensitive identification materials such as passports or national identity documents are not copied without a lawful and clearly defined basis.
The Article restricts duplication of these documents to situations where legal authority explicitly requires or authorizes the action.
Authority Directed Copying
The Article further explains that copying official documents becomes permissible when a competent public authority instructs the controller to make such copies under the Regulations. This condition confirms that the controller may only proceed when the request is formally issued and aligned with the regulatory framework. By requiring such authorization, the Article ensures that any copying of official documentation is controlled, monitored, and limited to authorized government or public sector functions.
This maintains accountability and prevents unauthorized handling of identification information.
