Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 29 governs when personal data may be transferred or disclosed outside the Kingdom. It establishes clear legal conditions that ensure cross-border data movement aligns with PDPL safeguards. The Article limits transfers to cases that meet explicit criteria, including treaty obligations, legal requirements, public interest needs, and other circumstances defined in the Law.
It also mandates that transfers must not undermine national security, public interests, or individual rights, and that only the minimum personal data necessary may be transferred. Emergency transfers and specific regulatory exemptions are also permitted under controlled conditions, ensuring international data movement remains lawful and strictly protected under the Personal Data Protection Law.
Saudi PDPL Article 29
- Subject to the provisions of Paragraph (2) of this Article, a Controller may Transfer Personal Data outside the Kingdom or disclose it to a party outside the Kingdom, in order to achieve any of the following purposes:
- If this is relating to performing an obligation under an agreement, to which the Kingdom is a party.
- If it is to serve the interests of the Kingdom.
- If this is to the performance of an obligation to which the Data Subject is a party
- If this is to fulfill other purposes as set out in the Regulations.
- The conditions that must be met when there is a Transfer or Disclosure of Personal Data, according to what is stated in Paragraph (1) of this Article, are as follows:
- The Transfer or Disclosure shall not cause any prejudice to national security or the vital interests of the Kingdom.
- There is an adequate level of protection for Personal Data outside the Kingdom. Such level of protection shall be at least equivalent to the level of protection guaranteed by the Law and Regulations, according to the results of an assessment conducted by the Competent Authority in coordination with whomever it deems appropriate from the other relevant authorities.
- The Transfer or Disclosure shall be limited to the minimum amount of Personal Data needed.
- Paragraph (2) of this Article shall not apply to cases of extreme necessity to preserve the life or vital interests of the Data Subject or to prevent, examine or treat disease.
- The Regulations shall set out the provisions, criteria and procedures related to the implementing this Article, including applicable exceptions for Controllers regarding conditions referred to in Subparagraphs (b) and (c) of Paragraph (2) of this Article, as well as controls and procedures for such exemptions.
Explanation of Saudi PDPL Article 29
Article 29(1)
Transfer Authorization Criteria
This clause establishes the primary legal grounds under which personal data may be transferred or disclosed outside the Kingdom. Transfers are permitted only when one of the specific justifications listed in sub-clauses A, B, or C is satisfied.
The Article ensures that international data movement is tied to lawful, documented, and purpose-bound needs.
Article 29(1)(a)
Treaty-Driven Transfers
This sub-clause permits cross-border personal data transfers when required to fulfill the Kingdom’s obligations under a binding treaty or international agreement.
Transfers under this basis must directly relate to the implementation of those obligations and cannot exceed what is necessary to honor the Kingdom’s commitments.
Article 29(1)(b)
Contractual-Obligation Transfers
This provision allows transfers when they are necessary to perform or fulfill a contract or obligation involving the Data Subject.
Transfers under this category must be directly connected to the Data Subject’s contractual arrangements and limited to what is strictly required to fulfill those obligations.
Article 29(1)(c)
Public-Interest Transfers
This clause authorizes transfers when necessary to protect the Kingdom’s interests or achieve a public interest. Such transfers must align with national needs and must be justifiable based on broader societal or governmental priorities.
The provision ensures that transfers carried out for public benefit remain lawful and proportionate.
Article 29(2)
Transfer Safeguard Conditions
This clause mandates additional requirements that must be met for any transfer justified under Paragraph (1).
The transfer must not contradict international commitments, must not threaten national or individual interests, and must adhere to strict data minimization principles.
Article 29(2)(a)
Agreement-Aligned Transfers
This provision requires that any transfer or disclosure conducted under Paragraph (1) must not conflict with treaties or agreements to which the Kingdom is a party.
It ensures that international legal obligations remain consistent and that cross-border data movement respects all binding commitments.
Article 29(2)(b)
Risk-Free Transfers
This clause prohibits transfers that could endanger national security, public interests, or the rights and interests of the Data Subject.
It places a legal obligation on controllers to assess and avoid risks before transferring personal data outside the Kingdom.
Article 29(2)(c)
Minimum-Necessary Transfers
This sub-clause requires controllers to restrict transfers to the minimum amount of personal data necessary.
It reinforces PDPL’s core data minimization principle and ensures that only essential information is shared for the specific lawful purpose.
Article 29(3)
Emergency-Driven Transfers
This provision creates an exception for cases of extreme necessity. Transfers are allowed when needed to preserve the life or vital interests of the Data Subject or to prevent, diagnose, or treat diseases.
These emergency transfers bypass the conditions in Paragraph (1) but still require controllers to act responsibly and proportionately.
Article 29(4)
Regulatory-Defined Exceptions
This clause delegates authority to the Regulations to define detailed controls, procedures, and exceptions for implementing Article 29. It covers cross-border processing scenarios not explicitly addressed in Paragraphs (1) and (3).
The provision ensures that additional lawful exceptions may be introduced while maintaining PDPL compliance safeguards.
