Saudi Arabia moving toward a progressive data protection regime

What the world is experiencing today is the Fourth Industrial Revolution — a new economy defined by digital transformation and driven by advances in artificial intelligence, robotics, the Internet of Things, cloud computing, cybersecurity, and more. The fuel of this new global economy is data.

As the value of data is becoming widely recognized, the way we think about how we collect, store, analyze and use data is now a highly pressing issue. Consumers are growing increasingly sensitive about how data is treated, and any legislation that defines this is a step out of the gray zone of how data is dealt with.

In September, Saudi Arabia approved a new personal data protection law, which was a welcome step in the right direction for the government, organizations, consumers and the economy as a whole.

Set to be implemented within five months, the law is designed to prevent personal data from being collected and processed without the user’s consent. By regulating the usage of personal data, the law will protect privacy and help prevent abuse.

The Kingdom has a thriving digital economy, which will only continue to grow in size and importance with the government’s strong investments in STEM fields, big tech and smart technologies, the most recent being its launch of technology initiatives in August worth more than $1.2 billion. As the Saudi government implements its digital and smart economy strategies, the amount of data collected will increase dramatically, which makes data regulation even more important.

So how will this new law benefit the government, businesses and the general public?

Firstly, establishing a unified personal data protection law will streamline compliance for companies across all sectors of the economy, making it easier for them to do business anywhere in Saudi Arabia. It will also bring the country’s data regulations in line with global best practices, making it easier for multinational corporations to conduct business within the Kingdom.

Secondly, the new law empowers individuals in terms of data ownership, ensuring that personal details, identification numbers, financial records and other sensitive information is not collected without permission. Therefore, the law will protect the privacy of individuals and reassure the public that the data they share with businesses will not be misused by third parties for fraudulent purposes.

For cybersecurity service providers, the key issues related to the personal data protection law revolve around security, privacy and compliance. Are businesses doing enough to protect the data they have accumulated from malicious behavior, and are their data management and protection practices compliant with the new laws and regulations? For example, is access to the data restricted to the appropriate employees through a secure privileged access management solution?

This is where cybersecurity specialists would come in to address and manage data security and compliance for their clients, taking the headache away from them. It is necessary to ensure that the data management and protection protocols in place are not only compliant with the Saudi data laws, but also in line with global best practices.

• Nicolai Solling is the chief technology officer at Help AG.