Overview
PDPL Implementing Regulation Article 18 sets the requirements a Controller must follow when processing Personal Data for a purpose different from the one for which it was originally collected. It explains how purposes must be defined, how documentation must reflect the scope of data needed, and how data minimization principles apply.
It also lists additional obligations when processing for new purposes under Article 10, including identifying the type of data and ensuring that the processing remains appropriate.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 18: Processing data for a purpose other than the one for which it was collected
- When the Controller processes Personal Data for a purpose other than the one for which it was initially collected as provided in Article 10 of the Law, it shall do the following:
- Clearly and specifically define the Processing purposes.
- Document the procedures to fix scope of data to be processed in accordance with specific purposes, including the use of data maps that indicate the need for each processed data and link it to each Processing purpose.
- Take necessary measures to ensure that the Personal Data is collected while respecting data minimization principle to achieve the purposes as set in paragraph (b) above.
- Except for cases stated in paragraph (3) of Article 10 of the Law, when the Controller processes Personal Data for a purpose other than the one for which it was initially collected as provided in paragraphs (1), (2), (4), (5), and (6) of Article 10 of the Law, the Controller shall comply with the following:
- Clearly and accurately define the purpose of the Processing and refer to it in the records of Personal Data Processing activities.
- Limit the Collection and Processing of the Personal Data to the minimum amount necessary to achieve the purpose.
- Identify the type of Personal Data to be processed and the necessary measures to ensure that such data is processed appropriately.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
