Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 37 defines SDAIA’s inspection and enforcement powers under the Personal Data Protection Law. The Article authorizes the Competent Authority to appoint inspectors, conduct compliance monitoring, investigate violations, and collaborate with criminal investigation bodies whenever necessary. It also empowers the Authority to seize tools, systems, or devices used in committing a PDPL violation until a final decision is issued.
This Article establishes the operational framework for oversight, investigation, and enforcement, ensuring lawful handling of personal data, consistent application of the Regulations, and coordinated responses to PDPL breaches across the Kingdom.
Saudi PDPL Article 37
- Employees and workers appointed by a decision of the president of the Competent Authority shall have the powers to control and inspect the violations stated in this Law or the Regulations. The president of the Competent Authority shall issue the rules and procedures in regard to the work of those employees and workers in accordance with the applicable laws.
- The employees and workers referred to in Paragraph (1) of this Article may seek assistance from criminal investigations authorities or other competent authorities to carry out their duties concerning control and inspection of violations stipulated in the Law or Regulations.
- The Competent Authority has the right to seize the means or tools used in committing the violation until a decision is made on it.
Explanation of Saudi PDPL Article 37
Article 37(1)
Inspection Authority Granted
This provision grants SDAIA the ability to appoint employees and workers who are legally empowered to inspect entities for PDPL compliance. These inspectors act under rules and procedures issued by the president of the Competent Authority, ensuring their activities are governed by clear legal standards.
This establishes a formal inspection mechanism to detect and address PDPL violations across all sectors.
Article 37(2)
Support From Authorities
Article 37(3)
Seizure Powers Authorized
This provision empowers the Competent Authority to seize any tools, systems, or devices used in committing a PDPL violation. These items may be held until a final decision is issued in the case.
This ensures preservation of evidence, prevents further unlawful processing, and supports effective enforcement actions.
