Overview
PDPL Implementing Regulation Article 31 sets limits on photographing or copying official documents issued by Public Entities when these documents contain identifiable Personal Data. Controllers must avoid copying such documents unless requested by a competent public authority or required by law. The Article also mandates secure handling, protection, and destruction of these documents once the purpose for which they were collected ends.
These safeguards reinforce PDPL principles of purpose limitation, confidentiality, and secure disposal.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 31: Photographing or Copying Official Documents that Reveal the Identity of Data Subjects
Without prejudice to the relevant laws, the Controller shall refrain from photographing or copying official documents - issued by Public Entities - where Data Subjects are identifiable, except upon request from a public Competent Authority or when required by Law. The Controller shall provide the necessary protection for such documents and destroy them once the purpose for which they were obtained has ended unless there is a legal requirement to keep them.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
