Overview
Regulation on Personal Data Transfer Outside the Kingdom Article 2 clarifies the additional purposes under which Controllers may transfer or disclose Personal Data to entities outside the Kingdom, beyond the purposes explicitly stated in the Law.
This Article links cross border transfers to Article 29 of the Saudi Personal Data Protection Law (PDPL) and defines specific operational, service related, and research driven purposes that may justify such transfers, provided that all applicable PDPL conditions and safeguards are satisfied.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 2: Other Purposes for Transferring or Disclosing Personal Data to Entities Outside the Kingdom
Other purposes for transferring or disclosing personal data to a party outside the Kingdom shall comply with subparagraph (d) of paragraph (1) of Article (29) of the Law, including:
- Performing necessary operations for central processing to enable the controller to conduct its activities.
- To provide a service or benefit to the subject of the personal data.
- Conducting scientific research and studies.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Definition of Other Purposes
This provision specifies the ‘other purposes’ referred to in PDPL Article 29(1)(d). A transfer or disclosure for central processing, to provide a service or benefit to the personal data subject, or for scientific research and studies is therefore a permissible purpose under the Regulation, subject to compliance with the PDPL requirements governing transfers outside the Kingdom.
Article 2(1)
Central Processing Operations
Article 2(2)
Providing Services or Benefits to Data Subjects
Article 2(3)
Scientific Research and Studies
This provision allows the transfer of Personal Data outside the Kingdom for the purpose of conducting scientific research or studies. Such transfers remain subject to the applicable safeguards under the Law and the Transfer Regulation, including data minimization, protection measures, and any additional conditions applicable to research related processing.
