Saudi Arabia's new privacy regulations are a sign of things to come in the GCC

Thu, 14 May 2020 09:00:00 +0400

On January 31 2020, Saudi Arabia’s Ministry of Commerce and Investment issued the Executive Regulations to the E-Commerce Law (Royal Decree No. M/126 dated 10 July 2019). These have now been published and impact any e-commerce firm selling to Saudis.

The regulations stipulate that e-commerce firms must perform a range of actions which are designed to protect Saudi consumers. Affected businesses must:

Put in place measures to protect consumer personal data.
Add a privacy policy on the E-store
Put in place a procedure to deal with consumer complaints
Add information to the Terms and Conditions
Add details to the invoice
Allow consumers to unsubscribe from electronic advertisements
Register on the Ministry’s commercial register (mandatory only for KSA registered entities)

We’re going to focus on the first point because it feels very much like a distillation of the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The regulations provide the following definition for consumer personal data: “any data – of whatever source of form – that identifies or is identifiable to a specific consumer”. This data includes names, ID numbers, addresses, contact details, registration documents, bank and credit card information, photographs, videos and more.

Saudi-Arabia on PeteMahon.net

Saudi Arabia's new privacy regulations are a sign of things to come in the GCC