KSAPDPL.COM

PDPL Compliance Services
PDPL Compliance in 4 Weeks
Start with PDPL Consulting
at HalaPrivacy.com

Table of Contents

← PDPL Compliance Ecosystem

Regulation on Personal Data Transfer Outside the Kingdom Article 1 – Definitions
Regulation on Personal Data Transfer Outside the Kingdom Article 2 – Other Purposes for Transferring or Disclosing Personal Data to Entities Outside the Kingdom
Regulation on Personal Data Transfer Outside the Kingdom Article 3 – Procedures and Standards for Evaluating the Level of Personal Data Protection Outside the Kingdom
Regulation on Personal Data Transfer Outside the Kingdom Article 4 – Cases in Which Controllers Are Exempt from the Requirements to Comply with the Appropriate Level of Protection and the Minimum Transfer of Personal Data
Regulation on Personal Data Transfer Outside the Kingdom Article 5 – Subsequent Transfer of Personal Data
Regulation on Personal Data Transfer Outside the Kingdom Article 6 – Revocation of Exemption
Regulation on Personal Data Transfer Outside the Kingdom Article 7 – Risk Assessment of Transferring or Disclosing Personal Data to a Party Outside the Kingdom
Regulation on Personal Data Transfer Outside the Kingdom Article 8 – Guides and Guidelines
Regulation on Personal Data Transfer Outside the Kingdom Article 9 – Enforcement

Regulation on Personal Data Transfer Outside the Kingdom Article 6 – Revocation of Exemption

  • This article is verified from SDAIA
  • halaprivacy.com
  • Updated: December 23, 2025
ChatGPT
Gemini Gemini
Claude Claude
Perplexity Perplexity

Overview

Regulation on Personal Data Transfer Outside the Kingdom Article 6 sets out the conditions under which previously granted exemptions for cross-border Personal Data transfers are revoked.

This Article empowers the Competent Authority (SDAIA) to withdraw exemptions where appropriate safeguards are not implemented or are deemed inadequate, and it imposes an immediate obligation on Controllers to halt transfers and notify recipients when revocation conditions arise.

SDAIA's Official Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 6: Revocation of Exemption

  1. None of the exemptions granted in accordance with the cases stipulated in Article (4) of the Regulation shall apply if any of the following situations arise:

    1. The controller has failed to implement the appropriate safeguards.

    2. If the competent authority determines that the appropriate safeguards are inadequate for any specific case.

  2. If any of the conditions stipulated in subparagraphs (a) and (b) of paragraph (1) of this Article are met, the controller shall halt the transfer or disclosure and notify the entities to whom the personal data was transferred or disclosed.

Plain-Language Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

Revocation of Exemption

Article 6(1)(A)

Loss of Exemption Due to Safeguard Failure

This provision establishes that exemptions granted under Article (4) automatically cease to apply where the Controller fails to implement the required appropriate safeguards for cross-border transfers.

Article 6(1)(B)

Authority Determination of Inadequacy

This provision confirms the authority of the Competent Authority to revoke exemptions where it determines, on a case-by-case basis, that the safeguards applied are inadequate to protect Personal Data.

Article 6(2)

Mandatory Halt of Transfer or Disclosure

This provision requires the Controller to immediately stop the transfer or disclosure of Personal Data once any revocation condition is met.

Notification of Data Recipients

This provision obliges the Controller to notify all entities to whom the Personal Data has been transferred or disclosed that the transfer has been halted due to the revocation of the exemption.

Saudi Personal Data Protection Law Compliance Services (KSA PDPL)

KSA PDPL Compliance Implementation

Achieve PDPL Compliance in 4 weeks or less.

Data Protection Officer As A Service (DPOaaS)

Let us handle your daily PDPL Compliance Operations.

KSA PDPL Compliance Audit (External)

Audit your PDPL compliance obligations.

Scroll to Top