Rules for Appointing Personal Data Protection Officer

Add Comment ؟

Required field
You can add your visuals to the project with no more than 5000 characters,1000 Characters left
user can hide his name by uncheck Visible in comments in profile Section,

Required field Wrong verification code

Add comment

Comments

(Blank)

Purpose
Agencies
Effect
Subjects

Article (1): Definitions

Add Comment

1. The terms and phrases mentioned herein shall have the meanings ascribed thereto in Article (1) of Personal Data Protection Law, hereinafter referred to as the “Law”, issued pursuant to Royal Decree No. (M/19) dated 09/02/1443 AH and amended pursuant to Royal Decree No. (M/148) dated 05/09/1444 AH and Article (1) of the Implementing Regulations of the Law, unless they have a specific definition herein.
2. The following terms and phrases, wherever mentioned herein, shall have the meanings ascribed thereto, unless the context requires otherwise:
Competent Authority: Saudi Data & AI Authority (SDAIA).
Controller: Any Public Entity, natural person or private legal person that specifies the purpose and manner of Processing Personal Data, whether the data is processed by that Controller or by the Processor.
Data Protection Officer (DPO): Any individual appointed by Controller to be responsible for protecting Personal Data, monitoring and overseeing procedures applicable by Controller to ensure compliance with the provisions of the Law and its Regulations, and receiving requests related to Personal Data in accordance with provisions of the Law and its Regulations.

Comments.

Add Comment

Article (2): Purpose

Add Comment

These Rules aim at:
1. Setting minimum requirements for appointing DPO.
2. Clarification of concepts related to cases in which Controller shall appoint DPO.

Comments.

Add Comment

Article (3): Scope of Application

Add Comment

These Rules shall apply to all Controllers covered by provisions of the Law and its Implementing Regulations.

Comments.

Add Comment

Article (4): Requirements for DPO Appointment

Add Comment

1. When appointing DPO, Controller shall ensure that the following requirements are met:
A.    Having appropriate academic qualifications and experience in the field of Personal Data protection.
B.    Having sufficient knowledge of Controller's business and activities that involve processing of Personal Data.
C.    Having sufficient knowledge of Personal Data breach risks.
D.    Having sufficient knowledge of regulatory measures for Personal Data protection and other relevant organizational measures for performing DPO tasks.
E.    Honesty and integrity, and not having been convicted of any offense involving dishonesty or breach of trust.
   2. DPO may be an executive, employee of Controller or an external contractor.
   3. The Competent Authority shall be entitled to request replacement of DPO if it is found that DPO is not competent.

Comments.

Add Comment

Article (5): Cases of Appointing DPO

Add Comment

First: Controller shall appoint one or more individuals to be responsible for protection of Personal Data in any of the following cases:
1.     Controller is a Public Entity that provides services involving Processing of Personal Data on a large scale.
2.     Controller core activities are based on processing operations that, by their nature, require regular and systematic monitoring of Data Subjects.
3.     Core activities of Controller are based on processing of sensitive Personal Data.
Second: The term "processing of Personal Data on a large scale" refers to:
1.     Processing operations that target a large group of Data Subjects.
2.     Processing operations that aim to process a considerable amount of Personal Data.
3.     Processing a wide variety of categories of Personal Data Subjects.
Third: The term “regular and systematic monitoring of Data Subjects” refers to:
Continuous processing by monitoring, tracking and profiling Data Subjects with the aim of improving or marketing services and products.
Activities that support Controller core activities shall not be considered core activities, such as processing job applications, payroll and other support activities at Controller.

Comments.

Add Comment

Article (6): Documenting DPO Appointment

Add Comment

1. DPO shall be appointed in writing, by documenting DPO appointment in case DPO is an employee of Controller or an external contractor.
2. DPO appointment and means of communication with DPO shall be immediately announced within Controller.

Comments.

Add Comment

Article (7): DPO Contact Details

Add Comment

1. Controller shall make DPO contact details, i.e. e-mail and phone number, available in a clear and accessible manner in Privacy Policy to Data Subjects.
2. Controller shall immediately provide Competent Authority with contact details of DPO upon their appointment through the National Data Governance Platform, provided that such details include name and contact details, including e-mail and phone number.

Comments.

Add Comment

Article (8): DPO Roles & Tasks

Add Comment

DPO shall be responsible for performing tasks stated in Paragraph (3) of Article (32) of the Implementing Regulations of the Law, in addition to the following tasks:
1.     Providing support and advice regarding all aspects of Personal Data protection, including contributing to developing policies and internal procedures related to Personal Data protection at Controller.
2.     Participating in awareness activities, training and transfer of knowledge to Controller personnel regarding Personal Data protection and compliance with provisions of the Law, Regulations and ethics of data handling.
3.     Contributing to reviewing plans of response to Personal Data Breach incidents, and ensuring that such plans are adequate and effective.

4.     Preparing periodic reports regarding Controller activities related to processing of Personal Data, and providing recommendations to ensure compliance with provisions of the Law and its Regulations.
5.     Maintaining the confidentiality of Personal Data and its level of sensitivity, based on its classification and relevant regulatory requirements to determine the adequate level of protection and processing mechanism.
6.     Monitoring the Competent Authority’s issued laws, regulations and instructions and the equivalent, implementing any amendments thereto and informing the relevant departments of the same to ensure compliance therewith.
7.     Collaborating with individuals responsible for implementing activities related to AI ethics to ensure that the requirements of Personal Data protection and Data Subjects’ privacy are met.

Comments.

Add Comment

Article (9): General Provisions

Add Comment

1.     Controllers shall periodically review DPO appointment cases to determine whether such cases are still required or likely to become mandatory according to provisions hereof.
2.     When making an agreement between Controller and Processor for the purpose of processing of Personal Data for and on behalf of Controller, Controller shall ensure that Processor has DPO or request appointment of DPO in cases that require appointing DPO with the aim of ensuring application of appropriate safeguards for implementing provisions of the Law and Regulations.
3.     When appointing DPO, Controller shall not assign tasks that may conflict with DPO tasks or affect DPO’s independence.
4.     The Controller shall work on training and developing DPO’s in the fields of Personal Data protection and support them in obtaining professional certificates in this field to ensure raising their efficiency.

Comments.