Saudi Arabia's Personal Data Protection Law gives people rights over their data and sets duties for controllers and processors, enforced by SDAIA as the competent authority. The Implementing Regulation adds the detail on notice, consent, breach reports, impact assessments and records, and a separate Regulation governs transfers outside the Kingdom.
Free account needed to download. You come straight back to the file.
Who it is for. Any controller or processor, public or private, that processes personal data of individuals in the Kingdom, including organisations abroad that process data of people residing there. Purely personal or family use is excluded.
What this list covers. Written on 7 November 2026 from the SDAIA website (sdaia.gov.sa): the Law in English as amended by M/148 (Article 32 repealed), the Implementing Regulation in English (September 2023), and the Regulation on Personal Data Transfer Outside the Kingdom, Version 2.0, August 2024, the version SDAIA's data protection page links (the 2023 Implementing Regulation file carries an earlier transfer text). The SDAIA Guide for Controllers and Processors (Version 1.0, December 2023) gave the commencement dates. Check SDAIA for later changes, and for the standard contractual clauses and National Register rules it issues.: 113 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| Art. 1 | Defined terms | Learn the Law's defined terms, because duties turn on them: personal data, sensitive data (including biometric, genetic, health and criminal-record data), controller, processor, disclosure, transfer and destruction. |
| Art. 2 | What the Law covers | The Law reaches processing of personal data about people in the Kingdom, including by parties abroad, and data of the deceased who could be identified. Purely personal or family use is outside it unless the data is shared or published. |
| Art. 3 | Stronger protection elsewhere still counts | The Law does not cut across another law or a treaty of the Kingdom that gives people a right or better protection for their data. Check sector rules too and follow whichever protects the person more. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 4(1) | Right to be informed | Tell people the legal basis for collecting their personal data and the purpose of the collection. |
| Art. 4(2) | Right of access | Let people see the personal data you hold about them, using the procedures in the Regulations and subject to the limits in Article 9. |
| Art. 4(3) | Right to a copy | On request, give a person their personal data in a clear, readable format, following the controls and procedures in the Regulations. |
| Art. 4(4) | Right to correct, complete or update | Correct, complete or update the personal data you hold about a person when they ask. |
| Art. 4(5) | Right to destruction | Destroy a person's data on request when they no longer need you to hold it, bearing in mind the retention duties in Article 18. |
| Art. 5(1) | Consent as the default basis | Do not process personal data, or change the purpose of processing, without the person's consent unless the Law provides another basis. The Regulations set the consent conditions, when it must be explicit and how a guardian consents. |
| Art. 5(2) | Withdrawal of consent | Let people withdraw consent at any time, using the controls the Regulations set for withdrawal. |
| Art. 6(1)-(3) | Processing without consent: interest, law, public entity | Consent is not needed where processing serves the person's actual interests but contact is impossible or hard, follows another law or an earlier agreement with them, or a public entity needs it for security or court purposes. |
| Art. 6(4) | Processing without consent: legitimate interest | You may rely on your legitimate interest in place of consent if it does not harm the person's rights and interests and no sensitive data is involved. The Regulations set the conditions. |
| Art. 7 | No bundling consent with a service | Do not make consent a condition of providing a service or benefit unless that service is directly tied to the processing the consent covers. |
| Art. 8 | Choose and watch your processors | Use only processors that give the guarantees needed to meet the Law and Regulations, and monitor their compliance. You stay answerable to the person and the authority, and the Regulations govern sub-contracts. |
| Art. 9(1) | Limits on access requests | You may set time frames for access requests, and may restrict access where it is needed to protect the person or others from harm, or where a public entity needs it for security, another law or court needs. |
| Art. 9(2) | Access you must refuse | Refuse access to personal data where giving it would fall within any of the first six situations listed in Article 16. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 10(1) | Collect directly and keep to the purpose | Collect personal data from the person themselves and use it only for the purpose you collected it for, unless one of the exceptions in Article 10 applies. |
| Art. 10(2)-(7) | Exceptions to direct collection and purpose limits | Other sources or new purposes are allowed with consent, for public data, for public entities' public-interest or security needs, to avoid harm, for public health or safety, for non-identifying data, or for legitimate interest without sensitive data. |
| Art. 11(1)-(2) | Lawful purpose and fair collection | Collect data for a purpose directly related to your own purposes and not unlawful. Use collection methods that are lawful, suited to the person's circumstances, direct, clear and secure, with no deception, misleading or extortion. |
| Art. 11(3)-(4) | Collect the minimum and stop when done | Collect only what the purpose needs and avoid content that would identify the person once the purpose is met. Stop collecting and destroy what you hold, without undue delay, when it is no longer necessary. |
| Art. 12 | Privacy policy | Have a privacy policy and make it available before you collect data. It must state the purpose, the data and the means of collection, how data is processed, stored and destroyed, and people's rights and how to use them. |
| Art. 13 | Notice at collection | When collecting directly, tell people the legal basis, purpose, which data is mandatory or optional, who collects it, who receives it, any transfer abroad, the risks of not collecting, and their rights. |
| Art. 14 | Accuracy before processing | Take enough steps to check that data is accurate, complete, up to date and relevant to its purpose before you process it. |
| Art. 15 | When disclosure is allowed | Disclose personal data only with consent, for data from a public source, for a public entity's public-interest or security needs, for public health or safety, in non-identifying form, or for legitimate interest without sensitive data. |
| Art. 16 | When disclosure is barred | Do not disclose under the consent, public-source, non-identifying or legitimate-interest grounds where it would threaten security, harm state interests or relations, hinder crime detection, endanger a person, or breach a legal duty. |
| Art. 17 | Pass corrections on | When you correct, complete or update personal data, tell every entity the data was transferred to and make the change available to them. The Regulations set the time frames. |
| Art. 18(1) | Destroy when the purpose ends | Destroy personal data without undue delay once it is no longer needed for its purpose. You may keep it only if nothing in it could identify the person, under the Regulations' controls. |
| Art. 18(2) | Keep when law or court requires | Keep the data after its purpose ends if a law requires a set retention period, or if it is closely tied to a case before a court. Destroy it when that period or case concludes. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 19 | Security measures | Put in place the organisational, administrative and technical measures needed to protect personal data, including while it is being transferred, following the Regulations. |
| Art. 20(1) | Breach notice to the authority | Tell the competent authority once you learn of a breach, damage or unlawful access to personal data. The Regulations set the content and the deadline. |
| Art. 20(2) | Breach notice to the person | Tell the affected person of a breach, damage or unlawful access that would harm their data or their rights and interests, as the Regulations require. |
| Art. 21 | Answer rights requests | Respond to people's requests about their rights within the period, and in the way, the Regulations set. |
| Art. 22 | Impact assessment | Assess the impact of processing on people for any product or service, to a depth suited to your activity and under the Regulations. |
| Art. 23 | Health data | The Regulations add controls for health data, including limiting access to medical files and processing to the fewest staff needed to deliver health services or health insurance. |
| Art. 24 | Credit data | The Regulations add controls for credit data, including checking that the person gave explicit consent to collection, a new purpose, disclosure or publication, and notifying the person when someone asks for their credit data. |
| Art. 25 | Advertising and awareness messages | Do not use a person's personal channels, such as post or email, for advertising or awareness material without their prior consent and a clear way to ask you to stop. Public entities' awareness material is excepted. |
| Art. 26 | Marketing use of data | Personal data other than sensitive data may be processed for marketing only if you collected it directly from the person and they consented, under the Regulations' controls. |
| Art. 27 | Research and statistics | Data may be collected or processed for scientific, research or statistical purposes without consent where it does not identify the person, the identity evidence is destroyed first, or another law or earlier agreement requires it. |
| Art. 28 | Copying official documents | Do not copy official documents in which people can be identified, unless the law requires it or a competent public authority asks for the copy under the Regulations. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 29(1) | Permitted purposes for transfers abroad | Transfer or disclose personal data outside the Kingdom only to perform an agreement the Kingdom is party to, serve the Kingdom's interests, perform an obligation the person is party to, or for other purposes in the Regulations. |
| Art. 29(2) | Conditions for transfers abroad | A transfer must not harm national security or vital interests of the Kingdom, must go where protection is at least equal to the Law (as the authority assesses), and must be limited to the minimum data needed. |
| Art. 29(3)-(4) | Transfer exceptions | The adequacy and minimum-data conditions need not be met in extreme necessity to protect life or vital interests or to deal with disease. The Regulations set other exceptions and their procedures. |
| Art. 30(2) | Data protection officer | Appoint one or more data protection officers in the situations the Regulations specify. The Regulations also set their duties. |
| Art. 30(3) | Cooperate with the authority | Cooperate with the competent authority in its supervision, and take the steps it asks of you on matters it refers to you. |
| Art. 30(4) | Authority's information and register powers | Expect the authority to demand documents or information, seek others' help, set monitoring tools, run a national register of controllers and charge fees for the services it provides. |
| Art. 31 | Records of processing | Keep records of your processing for the period the Regulations set and give them to the authority on request. Include contact details, purposes, categories of people, recipients, transfers abroad and expected retention. |
| Art. 33 | Accreditation, audit licences and overseas controllers | The authority sets requirements for data protection businesses and may license bodies that certify or audit controllers. It will also monitor controllers outside the Kingdom handling data of people residing in it. |
| Art. 34 | Right to complain to the authority | People may complain to the competent authority about how the Law and Regulations are applied. The Regulations set the rules for handling complaints. |
| Ref | Control | What it requires |
|---|---|---|
| Art. 35 | Criminal offence for sensitive data | Disclosing or publishing sensitive data in breach of the Law, intending harm or personal gain, carries up to two years in prison or a fine of up to three million riyals, or both. A court may double the fine for a repeat offence. |
| Art. 36 | Warnings and fines | Anyone covered by the Law who breaks it or the Regulations faces a warning or a fine of up to five million riyals, which may be doubled for a repeat violation. A committee decides and an appeal lies to the competent court. |
| Art. 37 | Inspection and seizure | Expect authorised inspectors to examine violations, with help from investigators, and the authority may seize the means or tools used in a violation until a decision is made. |
| Art. 38 | Confiscation and publication | A court may confiscate funds obtained through a violation. The court or the committee may also order a summary of the penalty published at the violator's expense once it is final. |
| Art. 39 | Staff discipline in public entities | A public entity must discipline any employee who breaks the Law or the Regulations, under the discipline rules that apply to them. |
| Art. 40 | Right to compensation | Anyone who suffers damage from a violation may ask a competent court for proportionate compensation for material or moral damage. |
| Art. 41 | Confidentiality continues | Anyone involved in processing personal data must keep it confidential even after their job or contract ends. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 1 | Regulation definitions | Know the Regulation's terms: direct marketing, personal data breach, vital, actual and legitimate interest, pseudonymisation, anonymisation and explicit consent, which must be provable. |
| Reg. Art. 2 | Personal or family use | Personal or family use means use within a family or limited social circle. Publishing data to the public, sharing it beyond that circle, or using it for professional, commercial or non-profit purposes is not covered by the exemption. |
| Reg. Art. 3(1) | Handling rights requests | Act on a rights request within 30 days, extendable by up to 30 more with notice and reasons. Put measures in place for prompt responses, verify the requester's identity, and keep a record of every request, oral ones included. |
| Reg. Art. 3(2)-(3) | Refusing requests; guardians | You may refuse a repetitive, manifestly unfounded or disproportionately burdensome request, telling the person why. A legal guardian exercises the rights of someone who lacks full or partial legal capacity. |
| Reg. Art. 4(1)-(2) | Information to give on direct collection | Before or at collection, give your identity and contacts, your DPO's contacts, the basis and purpose, retention period or criteria, rights and how to use them, how to withdraw consent, and whether the data is mandatory. Skip items they already have. |
| Reg. Art. 4(3)-(4) | Information when data comes from someone else | When data is collected from another person, inform the data subject within 30 days with the same details plus the data categories and source, unless they already know, it is impossible or disproportionate, or the law or secrecy rules apply. |
| Reg. Art. 4(5) | Extra information for higher-risk processing | If you process data of people lacking capacity at scale, monitor people continuously, use new technologies or decide by automated means, also describe how you handle sensitive data, how you protect data and whether decisions are solely automated. |
| Reg. Art. 4(6)-(7) | New purposes and people lacking capacity | Give the notice before processing for a different purpose from the original one. Where you know the person lacks full or partial capacity, give the information in language suited to them. |
| Reg. Art. 5 | Right of access | Give people access to their data on request or through a channel that lets them see it directly. Protect others' intellectual property and trade secrets, and never reveal another individual's identity in the process. |
| Reg. Art. 6 | Right to a copy | Provide a copy of a person's data in a commonly used electronic format, and on request a hard copy if feasible, without harming others' intellectual property or trade secrets or identifying any other individual. |
| Reg. Art. 7 | Right to correction and restriction | Restrict processing while a person contests accuracy and you check. You may ask for supporting evidence, which you must destroy after verifying, and you must promptly tell those who received the data once it is corrected. |
| Reg. Art. 8 | Right to destruction | Destroy data on request, when it is no longer needed, when consent was the only basis and is withdrawn, or when processing is unlawful. Ask recipients to destroy copies and delete your own, backups included, subject to Article 18 of the Law. |
| Reg. Art. 9 | Anonymisation | When you anonymise data, make re-identification impossible, assess the re-identification risk, apply measures as methods and technology change, and test that the techniques work. Truly anonymised data is not personal data. |
| Reg. Art. 10 | Channels for rights requests | Offer appropriate means for handling rights requests and let the person pick among those you offer, such as email, text messages, the national address, an app or another channel you provide. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 11(1) | Valid consent | Obtain consent that is freely given and not misleading, and not tied to a service in breach of Article 7. Explain clear, specific purposes first, ensure the person has capacity, keep proof of when and how, and seek separate consent for each purpose. |
| Reg. Art. 11(2) | When consent must be explicit | Obtain explicit consent when processing sensitive data, when processing credit data, and when decisions are made solely by automated processing. |
| Reg. Art. 12 | Withdrawal of consent | Set up withdrawal before asking for consent, and make it as easy as giving consent. After a withdrawal, stop processing without undue delay and ask recipients to destroy the data, but other legal bases and earlier processing are unaffected. |
| Reg. Art. 13 | Legal guardians | Check that a guardian really has authority before accepting their consent. Do not harm the person's interests, and let them exercise their rights themselves once they gain legal capacity. |
| Reg. Art. 14 | Proof for actual-interest processing | When processing in the person's actual interest because they cannot be reached, keep evidence that the interest exists and that contacting them is hard or impossible. |
| Reg. Art. 15 | Data from other sources | For data not taken from the person, keep processing necessary and proportionate to the purpose and avoid affecting their rights. Check that public-source data was collected lawfully, and anonymise where the non-identifying ground is used. |
| Reg. Art. 16(1)-(2) | Legitimate interest conditions | Rely on legitimate interest only if the purpose is lawful, you have balanced it against the person's rights, no sensitive data is involved, and the use is within what they would reasonably expect. Public entities cannot use it. |
| Reg. Art. 16(3)-(4) | Legitimate interest assessment | Before relying on legitimate interest, document an assessment of the processing, its purpose, its necessity, its possible harm and the safeguards. If it shows a breach or harm, change the processing, reassess or use another basis. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 17(1) | Processor contract contents | Make sure the processor gives sufficient guarantees and the contract states purpose, data categories and duration, breach notification, foreign legal exposure, mandatory disclosures with notice to you, and any subcontractors or recipients. |
| Reg. Art. 17(2)-(4) | Instructions, oversight and accountability | Give the processor clear instructions, assess its compliance periodically (an independent third party may do this) and expect it to tell you in writing of any breach of instructions. A processor that ignores them is treated as a controller. |
| Reg. Art. 17(5) | Sub-processors | Processors must make sure sub-contracts do not weaken protection, pick sub-processors with sufficient guarantees, and get your prior acceptance with notice and an agreed period in which you can object. |
| Reg. Art. 18 | Using data for another purpose | Before processing for a different purpose, define it clearly, record it in your processing records, map data to purposes, and collect and use only the minimum needed. Public-interest cases under Article 10(3) of the Law are excepted. |
| Reg. Art. 19 | Data minimisation | Collect and keep only the minimum personal data needed for the purpose, using means such as data maps that tie each data item to a purpose, and take care not to gather unnecessary data. |
| Reg. Art. 20(1)-(2) | Disclosure from public sources and general disclosure | Check that public-source data was not made public in breach of the Law. For other disclosures, tie each request to a specific purpose, protect privacy and limit the data to the minimum. |
| Reg. Art. 20(3)-(6) | Documenting disclosures | Document any request from a public authority and identify exactly what data is required. Balance other people's privacy, pseudonymise where possible, meet the legitimate-interest rules, and log disclosure dates, methods and purposes in your records. |
| Reg. Art. 21 | Public entity processing for public interest | A public entity doing public-interest processing must show it is necessary and within its legal mandate, limit possible harm, ensure its staff keep confidentiality, record the operations and collect only the minimum data. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 22 | Correcting personal data | When correcting data, verify against documents where needed, tell prior recipients and the person, and log each change. Suspend processing of data that is wrong and harmful until fixed, and review accuracy and timeliness periodically. |
| Reg. Art. 23 | Information security | Apply security measures that limit the risk of a breach. Follow the National Cybersecurity Authority's controls, or recognised best practice and cybersecurity standards if those controls do not bind you. |
| Reg. Art. 24(1)-(4) | Breach notice to the authority | Notify the authority within 72 hours of learning of a breach likely to harm data or people, describing it, the data and people affected, risks and fixes and your contact. Send missing items with reasons, keep copies and follow other reporting rules. |
| Reg. Art. 24(5) | Breach notice to the person | Tell affected people without undue delay, in simple clear language, when a breach may harm their data or conflict with their rights. Say what happened, the risks, your measures and contacts, and advise on how they can protect themselves. |
| Reg. Art. 25(1) | When an impact assessment is required | Write up the risk to people before processing sensitive data, linking datasets from different sources, large-scale continuous processing of data of people lacking capacity, continuous monitoring, new technology or automated decisions, or a high-harm service. |
| Reg. Art. 25(2)-(4) | What an impact assessment contains | Cover purpose and legal basis, the nature, scope and context of processing, necessity and proportionality, the severity and likelihood of harm and the measures to cut it. Give a copy to processors and redo it if harm shows. |
| Reg. Art. 26 | Health data | Protect health data from misuse, follow the health and insurance regulators' requirements, write the Law into your policies, split staff duties and access levels, record every stage and owner, bind processors and process the minimum. |
| Reg. Art. 27 | Credit data | Protect credit data from misuse, unauthorised access and disclosure, follow Saudi Central Bank requirements, and obtain consent and notify the person of any request to disclose their credit data. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 28 | Advertising and awareness messages | Get consent before sending such material where you had no earlier dealings with the recipient. Name yourself, give an easy free way to opt out that is as easy as consenting, stop at once when asked and keep proof of consent. |
| Reg. Art. 29 | Direct marketing | Before direct marketing, get consent under Article 11 and offer an opt-out as easy as consenting. Show who is sending, and stop without undue delay when consent is withdrawn. |
| Reg. Art. 30 | Research and statistics without consent | Without consent, record the research or statistical purpose in your processing records, collect only the minimum, pseudonymise where this does not defeat the purpose, and avoid harming the person's rights and interests. |
| Reg. Art. 31 | Photographing official documents | Do not photograph or copy official identity documents unless a public authority asks or the law requires. Protect any copies and destroy them once their purpose ends unless the law says to keep them. |
| Ref | Control | What it requires |
|---|---|---|
| Reg. Art. 32(1)-(2) | When a DPO is required | Appoint a data protection officer if you are a public entity processing at scale, if your main activity is regular systematic monitoring of people, or if your core activity is processing sensitive data. The officer may be an external contractor. |
| Reg. Art. 32(3)-(4) | What the DPO does | The officer monitors compliance and receives requests, is the authority's contact, oversees assessments and audits, supports people's rights and complaints, notifies breaches and keeps your processing records up to date. |
| Reg. Art. 33(1)-(4) | Keeping processing records | Keep written, accurate and current records for as long as you process the data and for five years after the activity ends. Give the authority access on request. |
| Reg. Art. 33(5)-(6) | What the records contain | Include your name and contacts, DPO details, purposes, data and people categories, retention periods, recipient categories, transfers abroad with their legal basis and recipients, and your security measures. The authority supplies templates. |
| Reg. Art. 34 | National Register of Controllers | The authority issues rules for registering in the National Register of Controllers, including which controllers must register. Check the rules and register if they apply to you. |
| Reg. Art. 35 | Accreditation bodies | The authority licenses bodies that issue accreditation certificates to controllers and processors, coordinating with the Digital Government Authority on services for government entities. |
| Reg. Art. 36 | Auditing and controlling | Auditors find gaps against the Law and Regulations. Licensed audit bodies must work independently and keep their work accurate. The authority sets the licensing rules. |
| Reg. Art. 37 | Complaints to the authority | A person may complain to the authority within 90 days of the event or of learning of it, and later for good reason. A complaint states the place and time, the complainant, the entity and a clear description with evidence. |
| Ref | Control | What it requires |
|---|---|---|
| Transfer Reg. Art. 1 | Transfer Regulation definitions | Know the defined terms: appropriate safeguards, operational processes, standard contractual clauses and binding common rules. |
| Transfer Reg. Art. 2 | Other purposes for transfers | Beyond Article 29(1) of the Law, you may transfer or disclose data abroad for central processing that your activity needs, to give the person a service or benefit, or for scientific research and studies. |
| Transfer Reg. Art. 3 | Countries with adequate protection | The authority publishes a list of countries and organisations with adequate protection and reviews it every four years or as needed. It may suspend transfers to a listed destination. Check the list before relying on adequacy. |
| Transfer Reg. Art. 4(1) | Safeguards that replace the conditions | Where an exemption from the adequacy or minimum-data conditions applies, use standard contractual clauses, binding common rules or an accreditation certificate, so that Law compliance and the person's rights, complaint and compensation rights hold. |
| Transfer Reg. Art. 4(2) | Cases for exemption and their safeguards | Exemption cases include public-body agreements, limited non-recurring transfers, group central operations, a direct service to the person and research. Each needs the safeguard the Regulation names for it, and sensitive data rules out some. |
| Transfer Reg. Art. 5 | Onward transfers | The Law and Regulations still apply when data you sent abroad is passed on to a further recipient, and you remain subject to Articles 8 and 15 of the Law and Article 17 of the Implementing Regulation. |
| Transfer Reg. Art. 6 | Stop and notify when an exemption lapses | If you fail to apply the safeguards or the authority finds them inadequate for a case, the exemption ends. You must halt the transfer and notify the entities that received the data. |
| Transfer Reg. Art. 7 | Transfer risk assessment | Before a transfer under an Article 4 exemption, or a continuous or widespread transfer of sensitive data, assess purpose, nature and scope, safeguards, data minimisation, possible harm and the measures to prevent or reduce it. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
Yes. The SDAIA Guide (Version 1.0, December 2023) says the Law came into force on 14 September 2023, with a one-year grace period to 14 September 2024 during which the competent authority would not apply penalties. Check SDAIA for any extension or later amendment.
Reg. Art. 24 requires notice to the competent authority within 72 hours of becoming aware of a breach likely to harm the data, the people or their rights, and notice to affected people without undue delay. Missing details follow as soon as possible with reasons for the delay.
Art. 35 punishes disclosing or publishing sensitive data to harm someone or for gain with up to two years in prison or a fine of up to three million riyals, or both. Art. 36 allows a warning or a fine of up to five million riyals for other violations. Both can be doubled for repeats.
Yes, for the purposes in Art. 29 of the Law and the Transfer Regulation, if it does not harm national security, goes where protection is adequate (or an exemption with safeguards applies) and is limited to the minimum needed. A risk assessment is required for exemption transfers.
No. Reg. Art. 32 requires one for public entities processing at scale, for controllers whose main activity is regular systematic monitoring of people, and for those whose core activity is processing sensitive data.
It has a similar rights and controller-duty structure, but consent is the default basis, legitimate interest is barred for sensitive data and public entities, and transfers depend on SDAIA's adequacy list or approved safeguards.
No. It is a plain-English summary in our own words, following the article numbers of the Law, the Implementing Regulation and the Transfer Regulation. The official texts from SDAIA are the authority, and sector rules also apply.