Introduction

In 2023, India and Saudi Arabia every printed new legal guidelines and laws increasing on current or setting forth new complete knowledge privateness legal guidelines. This article summarizes the notable developments in these jurisdictions, particularly specializing in the up to date obligations and requirements concerning cross-border transfers (i.e., when private info is transferred from one nation to a different nation). While organizations could already adjust to a few of these developments by advantage of complying with equally instituted privateness legal guidelines, organizations ought to take steps to know totally their obligations to realize statutory compliance and reduce the danger of authorized or monetary legal responsibility.

India

After a few years in growth, the Digital Personal Data Protection Act 2023 (the “Act”) was handed by the Indian Parliament in August 2023. The Act is predicted to turn out to be efficient in June 2024 and can supersede related provisions within the Information Technology Act, 2000, the Information Technology (Amendment) Act, 2008, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

This Act establishes India among the many international powers with a complete privateness legislation. However, its creation was not with out challenges. India confronted criticism from knowledge fiduciaries (any group that determines the information processing functions and means), notably for the stringent cross-border necessities proposed in earlier drafts of the Act. The beforehand proposed Digital Personal Data Protection Bill 2022 (the “Bill”) appeared to counsel default restrictions on cross-border knowledge transfers, permitting solely preselected international locations permitted by the Central Government, forming a whitelist for such international locations. However, this strategy considerably restricted the variety of permitted international locations, requiring the international locations to match or surpass India’s degree of knowledge safety and be notified by the Central Government of their approval to whitelist the respective nation. The Bill additionally lacked specifics on how the Central Government would choose and notify the white-listed international locations or the phrases and circumstances for these transfers, together with the transfers of delicate or essential private knowledge that probably affected compliance and localization necessities.ⁱ This uncertainty raised issues amongst knowledge fiduciaries, given India’s important function in international knowledge processing.

The Act, nonetheless, takes a extra relaxed stance on cross-border knowledge transfers in comparison with the sooner Bill. As of now, the Act doesn’t prohibit the cross-border knowledge transfers until the Central Government notifies the particular nation of the information switch prohibition.ⁱⁱ This important deviation from the proposed Bill permits knowledge fiduciaries to function with out the concern of noncompliance repercussions. The Act additionally maintains current sectoral legal guidelines governing industries like banking and telecommunications, preserving their restrictions on crossborder knowledge transfers. Additionally, the Act’s extraterritorial attain applies to digital private knowledge processing outdoors India if the processing is in reference to any exercise referring to providing items or providers to people inside India, aligning with international privateness legal guidelines.

It contains compliance exemptionsⁱⁱⁱ for particular circumstances, permitting crossborder knowledge transfers to unapproved international locations and the Central Government and its businesses. Those exemptions are as follows:

• processing of non-public knowledge that’s obligatory for the enforcement of a authorized proper or declare;
• prevention, detection, investigation, or prosecution of offenses and contraventions below the Indian legislation;
• processing of non-public knowledge by any court docket or tribunal or another physique in India for judicial, quasi-judicial, regulatory, or supervisory capabilities;
• processing private knowledge of knowledge principals outdoors India pursuant to a contract entered into with a international entity;
• processing pursuant to legally permitted mergers, demergers, acquisitions, and different such preparations between knowledge fiduciaries; and
• processing private knowledge to establish the monetary place of a defaulter to a monetary establishment.

Ultimately, the Act presents a broad basis, outlining the fundamentals of a complete privateness legislation in India. The implementation and enforcement of the Act is predicted to emerge from the Central Government within the type of guidelines and laws. The Data Protection Board of India will oversee compliance with this Act and situation corrective orders and penalties for noncompliance.

Key takeaways for Organizations:

While no particular timelines for compliance have been supplied, organizations ought to:

• Regularly assessment and entry their knowledge flows out of India.
• Ensure that correct knowledge switch agreements are in place.
• Once made obtainable by the Central Government, commonly test the listing of restricted international locations to keep away from noncompliance penalties.
• Non-compliance penalties might attain as much as Rupees 2.5 billion (approx. $30 million).

Saudi Arabia

On September 7, 2023, the Saudi Data and Artificial Intelligence Authority issued each the Implementing Regulation of the Personal Data Protection Law (the “Implementing Regulation”) and the Regulation on Personal Data Transfer outdoors the Kingdom (the “Transfer Regulation,” and collectively with the Implementing Regulation, the “Regulations”) to make clear and complement the Kingdom of Saudi Arabia (“KSA”) Personal Data Protection Law (“PDPL”)^iv. Together, the PDPL and Regulations are designed to parallel different worldwide privateness legal guidelines and set up complete knowledge safety requirements inside KSA.

Cross-Border Transfers

Article 29 of the PDPL and the Transfer Regulation prescribe how knowledge controllers^v can legally switch private knowledge^vi outdoors the KSA or to a celebration outdoors the KSA. Under Article 29, knowledge controllers could provoke such switch if the switch is (1) associated to performing a contractual obligation the place the KSA is a celebration, (2) to serve the pursuits of the KSA, (3) carry out an obligation the place the information topic is a celebration to such obligation, or (4) fulfill the needs within the Regulations.^vii Except in instances of maximum necessity or to stop accidents or illness, Article 29 additional requires that knowledge transfers are solely permissible when (a) the switch won’t prejudice nationwide safety or the very important pursuits of the KSA, (b) there’s an ample degree of safety outdoors the KSA, and such adequacy is established by an evaluation carried out by a reliable authority within the KSA, and (c) the private knowledge transferred is restricted to the minimal quantity obligatory.^viii Assuming a knowledge controller satisfies these necessities, a knowledge controller could legally switch such private knowledge outdoors the KSA.

Markedly, the Transfer Regulation expands on Article 29 by describing in additional element the standards and procedures for cross-border transfers. While the Transfer Regulation reinforces a few of Article 29’s necessities (e.g., by guaranteeing knowledge transfers won’t influence nationwide safety), the Transfer Regulation additionally requires knowledge controllers to make sure the switch doesn’t adversely have an effect on the extent of privateness afforded to non-public knowledge.^ix For occasion, the switch should not compromise an individual’s proper to withdraw consent to knowledge processing or a knowledge controller’s capacity to inform knowledge topics in case of a knowledge breach.^x Further, the Transfer Regulation expands on the needs for a switch in Article 29 paragraph 1 by permitting knowledge controllers to switch private knowledge if (1) the switch will allow the information controller to “carry out its activities,” (2) the switch will present a service or profit to the information topic, or (3) the switch is for conducting scientific analysis.^xi Moreover, the Transfer Regulation requires knowledge controllers to carry out danger assessments for transfers the place the jurisdiction doesn’t have ample ranges of safety or constant transfers of delicate knowledge.^xii

Additionally, the Transfer Regulation requires a reliable authority (to be decided later by the Council of Ministers) to judge the protections of non-public knowledge outdoors the KSA primarily based on enumerated standards and suggest adequacy choices primarily based on such evaluations,^xiii just like the EU-US adequacy resolution printed in July 2023. These evaluations assist knowledge controllers guarantee the private knowledge is transferred to a jurisdiction with an ample degree of safety to adjust to Article 29 of the PDPL.

Finally, the Transfer Regulation gives some exceptions the place a jurisdiction doesn’t have ample protections. If a jurisdiction doesn’t have the ample ranges of safety, the information controller should still switch the private knowledge supplied the opposite jurisdiction doesn’t prejudice the privateness of the private knowledge topic or the information controller’s functionality to implement applicable safeguards.^xiv In instances the place a jurisdiction doesn’t have the ample ranges of safety or a knowledge controller can’t implement the suitable safeguards, the KSA permits knowledge controllers to conduct transfers as long as (1) the switch is critical for performing obligations the place the information topic is a celebration, (2) the information controller is a public entity and the switch is critical to guard KSA’s nationwide safety or for the general public curiosity, (3) the information controller is a public entity and the switch is critical to analyze or detect crimes, or (4) the switch is critical to guard a knowledge topic’s very important pursuits who can’t be contacted.^xv However, these exemptions should not relevant and a knowledge controller should instantly cease or forestall any such transfers if (a) the switch negatively impacts KSA’s nationwide safety or very important pursuits, (b) there’s a excessive danger to a knowledge topic’s privateness primarily based on the outcomes of a danger evaluation, (c) the adopted applicable safeguards not apply, or (d) the information controller can’t implement the suitable safeguards.^xvi

Compliance and Consequences

Data controllers have a one-year grace interval ending on September 14, 2024, to adjust to the PDPL and accompanying Regulations. Notably, the PDPL and Regulations comprise different provisions along with cross-border transfers that handle, amongst different issues, knowledge topic rights, info safety requirements, and knowledge controller obligations concerning processers. Deliberately violating the PDPL and its Regulations with the intent to hurt might end in imprisonment for 2 years or a fantastic of three,000,000 riyals (or roughly $800,000 USD).^xvii Other failures to adjust to the PDPL and its Regulations danger fines of as much as 5,000,000 riyals (or roughly $1.3 million), which can be doubled for repeat offenders.^xviii

Key Takeaways for Organizations

Before the grace interval ends in 2024, organizations ought to:

• Review knowledge processing actions and privateness compliance applications;
• Update actions and applications to adjust to the PDPL and its Regulations as obligatory;
• Review or audit preparations with processors/sub-processors to assist guarantee compliance; and
• Educate staff on obligations for the group and themselves.

iThe Bill didn’t outline the phrases delicate private knowledge or essential private knowledge.

ii The Digital Personal Data Protection Act 2023, Bill No. 113-C of 2023, Chapter IV §16(1).

iiiThe Digital Personal Data Protection Act 2023, Bill No. 113-C of 2023, Chapter IV §17(1)

ivRoyal Decree No. M148 of 05/09/1444H, M/19 of 9/2/1443H (2023)

v “Controller” is outlined as “[a]ny Public Entity, natural person or private legal person that specifies the purpose and manner of Processing Personal Data, whether the data is processed by that Controller or by the Processor.” Id. at artwork. 1(18).

vi “Personal Data” is outlined as “[a]ny data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature.” Id. at artwork. 1(4).

vii Id. at artwork. 29(1).

viiiId. at artwork. 29(2).

ix The Implementing Regulations of the Personal Data Protection Law, Regulation on Personal Data switch outdoors the Kingdom, chap. 1, artwork. 2 (2023).

x Id.

xiId.

xii Id. at chap. 4, artwork. 8.

xiiiId. at chap. 2, artwork. 3.

xiv Id. at chap. 3, artwork. 5.

xv Id. at chap. 3, artwork. 6.

xvi Id. at chap. 3, artwork. 7.

xvii Royal Decree No. M148 of 05/09/1444H, M/19 of 9/2/1443H (2023), artwork. 35(1).

xviii Id. at artwork. 36(1).