When renowned data science entrepreneur Clive Humby coined the phrase ‘data is the new oil’, he had his good set of analogies. The most important element in that comparison was that data and oil aren’t very useful when unrefined. Thus, it’s the analysis that makes data priceless. It’s the ‘good’! Unfortunately, if exploited, the ‘bad’ and ‘ugly’ take over. This is the very reason why so many countries around the world have data protection laws in place for their citizens.
All data protection laws have one primary agenda—privacy shouldn’t be violated. Such laws apply to all organizations or business entities that possess the personal information of people or their customers. European Union’s GDPR (implemented on May 25, 2018) was the epicenter of many debates and made headlines all those years ago due to its business impact and implications. Even at a state level, California (US) has the California Consumer Privacy Act (CCPA) to safeguard the privacy rights of its citizens.
The latest country to enter the legal space of data privacy is Saudi Arabia, with the inking of the Personal Data Protection Law (PDPL).
PDPL: Overview and Essentials
The Official Gazette of the Kingdom of Saudi Arabia (KSA) published the Personal Data Protection Law (PDPL) on September 24, 2021. It is slated to come into effect on March 23, 2023, and applies to every organization with business operations in the country, irrespective of the industry. The intention is to protect any data/information falling under the purview of PII—personally identifiable information. This can cover details like names, addresses, contact numbers, pictures, videos, and any other private information of the citizens of Saudi Arabia.
Whether homegrown or a multinational corporation (MNC), all businesses in Saudi Arabia must adhere to every aspect of the PDPL when collecting, processing, disclosing or retaining personal data. Similar to any data privacy protection law, it’s all about consent. The PDPL states that consent from individuals is necessary before organizations collect or process any of their data. Next comes transparency. Organizations must disclose their data privacy policy explaining how a person’s data will be processed. In case the data no longer serves the purpose for which it was collected in the first place, organizations are obligated to delete such data from their repository. In addition, as per the PDPL, businesses can’t conceal any unauthorized access and data breaches or leaks from Saudi Arabian authorities. If any such security incidents lead to material losses, organizations must inform the individual whose data has been jeopardized.
In a nutshell, PDPL enforces that organizations are solely accountable for any personal data violations of the citizens of Saudi Arabia.
PDPL Compliance Using Scalefusion
Scalefusion offers an intuitive and robust mobile device management (MDM) solution that helps organizations of all sizes monitor, control and secure their endpoints and the data stored in them. Scalefusion MDM puts data security at the center stage with features that allow IT admins to be on top of security policies.
Once PDPL comes into effect, many businesses might get skeptical about their customer data stored on the cloud in data centers outside Saudi Arabia. Even with consent and all the legal agreements, the skepticism is understandable, considering the repercussions of being non-compliant with PDPL. IT and security teams of such businesses need not worry. Scalefusion provides the option of on-premise deployment to ensure that organizations’ customer data remains within their premises.
Some organizations might prefer to store or already have their data in data centers within Saudi Arabian or GCC soils. In such cases, Scalefusion provides extensive support for VPC (virtual private cloud). Scalefusion can set up a VPC that allows organizations to define and isolate their virtual networks within public cloud environments where shared resources rest.
In short, the Scalefusion MDM solution covers one of the most important requisites of the Personal Data Protection Law, wherein all the customer data of organizations needs to be stored within Saudi Arabian or GCC shores.
To Conclude
PDPL is all set to arrive in Saudi Arabia, and any organization operating in the country has no room for non-compliance. Organizations must embrace PDPL as like the GDPR or CCPA, it is all about protecting what is the fundamental right of citizens in the digital age—data privacy.
Compliance with regulatory standards like the PDPL is integral to the Salefusion MDM solution. To know more, schedule a demo and speak to our product experts. There’s also the option of a 14-day free trial to look into all the features Scalefusion offers.
