Draft Amendments to the PDPL Implementing Regulation Are on Istitlaa: What Should Your Online Store Review in Its Privacy Policy Now, and How Does It Keep the Policy Current?

What has been put on Istitlaa, and what has not changed yet

The consultation page published under SDAIA shows a table of the proposed amendments to the Implementing Regulation. We mention here only what in that table touches a store's privacy policy, as a proposal that may change after the consultation ends, without any numbers or periods, because the final wording may differ from the draft.

• A proposed new provision specific to the privacy policy, asking that it be written in clear, simple language suited to different levels of understanding and consistent with the language in which the service is delivered, while allowing it to be published in more than one language provided Arabic is one of them.
• Simplifying the language in which information is given to data subjects in general, not only to one category of them.
• Proposed provisions on the storage of personal data, one of the points a store that hosts or processes its data with providers should follow.
• Proposed changes to the rules on promotional messages, direct marketing and the way to opt out of them, and on records of processing activities and the personal data protection officer.

More important than the details of the draft is what has not changed: your reference today is the Personal Data Protection Law and its amendments and the Implementing Regulation in its current text, and it stays that way until any amendments are adopted, officially published and take effect. So do not rewrite your policy to match the draft. Review it against the text in force, and set up a way of working that lets you update quickly if the final wording is issued.

The eight sections a store privacy policy must show

The Law requires the controller, which here is your store, to adopt a privacy policy and make it available to data subjects when their data is collected, covering the purpose of collection, the content of the data, how it is collected, how it is kept, how it is processed and destroyed, and the data subject's rights and how to exercise them. The Law adds elements the customer must be made aware of when data is collected directly from them, including the legal basis, the identity of whoever collects the data, the parties the data will be disclosed to and whether it will be processed outside the Kingdom. The Implementing Regulation of the E-Commerce Law asks the store to disclose its privacy policy including the measures that protect consumer data and the scope of handling user identification files, if any. From these texts we arrange the sections into eight review steps:

1. Who collects the data: the business's official name as in its register, the store's trade name, a short description of its activity, and how to contact it. Check that the name and register match reality after any change in the entity or ownership.
2. What data is collected: account data, order and delivery data, payment data, data collected automatically through cookies and analytics, and data received from other parties, stating which of it is mandatory and which is optional.
3. The purpose of collection: a specific, clear purpose for each category of data, such as fulfilling the order, customer service or marketing, directly linked to the store's activity.
4. The legal basis: the ground you rely on for each processing activity, such as consent, performing an agreement the customer is party to, a legal requirement, or a legitimate interest of the store, stating how consent can be withdrawn where it is the basis.
5. Sharing with providers: the parties the data is disclosed to and their capacity, such as the payment provider, the shipping company, the hosting provider and the store platform, the purpose of each disclosure, and whether any data is transferred or processed outside the Kingdom.
6. Storage, retention and destruction: where the data is stored, the measures that protect it, how long each category is kept, and how it is destroyed once the purpose ends.
7. The customer's rights: the right to be informed, to access their data, to obtain a copy in a readable and clear format, to ask for it to be corrected, completed or updated, and to ask for the destruction of what is no longer needed, stating how each request is made.
8. The contact point and complaints: the channel through which the store receives requests and complaints, the personal data protection officer if the store is one that must appoint one, and a statement of the customer's right to take a complaint to the competent authority.

How to review each section against the Law and its current Regulation

Most store policies do not contradict the Law in their wording; they fall behind reality. They are written at launch, then the store adds a new payment gateway, a shipping company, an analytics tool or a messaging campaign, and the policy stays as it was. So the review starts from reality, not from the text. Build three lists before you open the policy: a list of the data the store actually collects in every form and page, a list of every provider that touches that data, and a list of the periods you actually keep it. Then compare each of the eight sections with these lists.

• Is every field in the sign-up and order forms listed in the data section, and is there a field you do not actually need for the purpose? The Law limits the content of data to the minimum needed for the purpose.
• Does every purpose have a stated legal basis, and are promotional messages built on a sound basis with a clear way to opt out of them?
• Does the list of providers in the policy match the actual list, and do you have a processing agreement with every provider that processes data on your behalf? The Law requires the controller to choose a processor that offers the necessary guarantees and to verify its compliance.
• Are the retention periods stated the periods actually applied? The Law requires data to be destroyed without delay once the purpose ends, unless a legal basis requires keeping it for a set period or it is closely connected to a pending case.
• Have you tested the rights and complaints channel yourself, and does a request reach a responsible person who answers it?
• Is the policy written in clear language an ordinary customer understands, published in Arabic, and reachable through a visible link in the store and at every collection point?

Log the review date and republish in an orderly way

A review that is not documented is as if it never happened. SDAIA's guideline on preparing a privacy policy directs the controller to review the policy periodically, to record any change or update in an update log, and to show the date of the last update. The Implementing Regulation of the E-Commerce Law also asks the store to provide access to the information it must disclose through a link in its online store, with any amendment to it made clear. The following steps turn this into a fixed habit:

1. Keep a dated copy of the current policy before any change, so you know what was published on each date.
2. Record in an internal log the review date, who carried it out, the sections reviewed, the text in force it was reviewed against, and what was decided to change and what to keep.
3. If anything changed, update the last-updated date at the top of the policy, and add a line to the published update log summarising what changed in plain language.
4. Publish the new version in Arabic and English together, and check that the same link works in the store footer, the checkout page, the sign-up forms and the mobile app, if there is one.
5. If the change is material, such as adding a new purpose or a new provider outside the Kingdom, inform customers of it by a suitable means, and check whether the change needs a new legal basis such as consent.
6. Set the date of the next review in your compliance calendar, and add the triggers for an extra review: a new provider, a new feature that collects data, or a legal amendment that is officially published.

When the amendments are issued in final form

A store does not need to follow every news item, only two official sources: the SDAIA website and the Istitlaa platform to know the path of the draft, and the official gazette Umm Al-Qura to know what has been adopted and published and when it takes effect. Until that happens, the draft remains material to read and comment on, not a basis for changing the policy. If you want your store's voice heard, the platform itself allows comments on the draft.

1. On official publication, read the adopted text, not news summaries, and identify the provisions that touch the eight sections of your policy.
2. Repeat the earlier review steps on the affected sections only, against the new text, and record this in the review log with the date of official publication.
3. Review the related documents alongside the policy: the data processing agreements with providers, the cookie notice and the store terms, so that no document says something another contradicts.
4. Publish the updated version before the amendments take effect where possible, and update the last-updated date and the published update log.

Sighaty's Privacy Policy template D-03 is certified by a licensed Saudi lawyer and kept current as the law changes, so if the amendments are issued in final form you will find its updated version in Arabic and English instead of redrafting yourself. Alongside it, the Data Processing Agreement template I-04 covers the contract with every provider that processes your customers' data on your behalf.

Frequently asked questions