Cross-border data transfers affect all organizations that engage online IT services, cloud-based services, remote access services and global HR databases. Understanding the applications of lawful data transfer mechanisms is essential to validate recipients located in other nations. Data transfers typically include the following examples:
Saudi Arabia’s new Personal Data Protection Law (PDPL) limits controllers transferring personal data outside of the country, but until the executive regulations are released, it is unclear when personal data transfers will be permitted.
Under the PDPL, personal data can only be transferred by controllers:
When personal data transfers are permitted, they must meet the following requirements:
In certain instances, the Cloud Computing Regulatory Framework (CCRF) may apply. Under the CCRF, cloud service customers are required to categorize their data into one of 4 categories. Data that is categorized as ‘Level 3’ or ‘Level 4’ cannot be transferred outside the country or processed in a public cloud. HR related employee data would generally be classified as ‘Level 1’ or ‘Level 2’ data. In some instances employers in certain regulated industries or who hold highly sensitive staff data may use a ‘Level 3’ categorization, which would prohibit data from being transferred outside Saudi Arabia.
HR Best Practices: The use of applications in the cloud frequently results in the international transfer of employee data. The executive regulations should provide more clarity on when international personal data transfers are permitted and how limited exceptions may apply.