KSA PDPL » Saudi PDPL Article 17 – Personal Data Correction and Notification Duties

Saudi PDPL Article 17 – Personal Data Correction and Notification Duties

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 10, 2025
Updated: January 10, 2026

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 17 requires Controllers to notify all entities that previously received a Data Subject’s Personal Data whenever that data is corrected, completed, or updated. This ensures that earlier recipients no longer rely on inaccurate, incomplete, or outdated information and helps maintain consistent data accuracy across all processing activities.

Article 17 also authorizes the Regulations to specify the required time frames for making corrections and updates, the types of permissible corrections, and the procedures needed to prevent harm that may result from processing incorrect or outdated Personal Data.

SDAIA's Official PDPL Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 17

If Personal Data is corrected, completed or updated, the Controller shall notify such amendment to all the other entities to which such Personal Data has been transferred and make the amendment available to such entities.

The Regulations shall set out the time frames for correction and updating of Personal Data, types of correction, and the procedures required to avoid the consequences of Processing incorrect, inaccurate or outdated Personal Data.

Plain-Language PDPL Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

PDPL Article 17(1)

Notification of Corrections

This provision requires Controllers to notify every entity that previously received the Data Subject’s Personal Data whenever that data is corrected, completed, or updated. The Controller must ensure that the corrected version is made available so that earlier recipients no longer rely on inaccurate or outdated information.

This requirement prevents ongoing use of data that no longer reflects the amended details and ensures that all parties who received the original information operate on accurate records.

PDPL Article 17(2)

Regulatory Correction Framework

This provision confirms that the Implementing Regulation will determine the time frames for making corrections and updates, the accepted categories of correction, and the procedures needed to prevent harm caused by inaccurate or outdated Personal Data. These regulatory rules provide structure for how Controllers must act once they identify incorrect or incomplete information.

The provision ensures that Controllers follow consistent procedures that preserve the integrity and accuracy of Personal Data throughout its lifecycle.

Frequently Asked Questions (FAQs)

Under the Saudi Personal Data Protection Law (KSA PDPL), who is responsible for correcting inaccurate personal data, the user or the business?

The Controller is responsible for correcting inaccurate data once the Data Subject requests it or the Controller becomes aware of the inaccuracy. Users may initiate the change, but the duty to correct sits with the Controller.

In e commerce, if a customer updates their address, do we have to update all systems or just the one they used?

Article 17 expects the Controller to correct the data wherever it is processed. In practice, this means ensuring the correction carries through all relevant systems under your control.

For HR in KSA, if an employee corrects their information, do we need to notify payroll and benefits providers?

Yes, if those parties received the inaccurate data from you. Article 17 requires the Controller to notify any party that received incorrect data so they can update it on their end.

Are Processors required to correct data directly if a user contacts them?

No, the Processor must follow the Controller’s instructions. The Controller decides what corrections need to be made, and the Processor implements them based on those instructions.

Does Article 17 require notifying every vendor who ever received the data?

Only those to whom the inaccurate data was disclosed. The purpose is to ensure corrected data is reflected wherever the incorrect version was used.

In fintech, if a user corrects their ID number, do we have to inform partners like KYC providers?

Yes, if you previously shared the inaccurate ID with them. Article 17 requires notifying each party that relied on incorrect data.

Does Article 17 cover both minor errors and major identity details?

Yes, any inaccurate or incomplete Personal Data falls under the correction obligation. The scale of the error does not change the duty to correct.

What if correcting the data could create harm or conflict with another legal duty?

Article 17 must be read alongside other PDPL provisions and applicable laws. In practice, the Controller considers both the correction request and any limitations in the broader legal framework.

In healthcare, must corrected medical records also be updated with external labs or clinics?

Yes, if the incorrect data was previously shared with them. Article 17 requires notifying those parties so the corrected information can be reflected.

Common misconception, “If the data was wrong because the user entered it, we do not have to fix it.” Is that true under Saudi PDPL?

No, Article 17 still places the correction duty on the Controller. It does not matter how the inaccuracy occurred.

Does Article 17 require notifying the Data Subject after their correction request is completed?

Article 17 focuses on fixing the data and notifying external recipients, but informing the Data Subject is consistent with good practice under PDPL transparency principles. Many Controllers notify the user once the correction is done.

If we maintain historical logs, do we have to delete every old version when data is corrected?

Article 17 requires correction of inaccurate data used for processing, not erasing all historical records. In practice, organizations ensure the active data used for decisions is correct, while handling historical logs under retention and accuracy rules.