The short answer
Saudi Arabia’s Personal Data Protection Law (PDPL) classifies health data as sensitive data, bars using legitimate interest as a basis for processing it, and requires access to health data to be limited to the minimum number of staff needed.1 SDAIA’s Implementing Regulation adds controls for health data: follow the health and insurance regulators’ rules, separate duties, document every stage of processing with the person in charge of each, and process only the minimum necessary.2 Breaches that may cause harm go to the competent authority within 72 hours.2 This post summarises the published English texts; check SDAIA for the current versions.
Deedglass
Your data stays on your servers
Your own servers
Health data is sensitive data
The law’s definitions do the classification. Sensitive data includes data revealing racial or ethnic origin, religious, intellectual or political belief, criminal convictions, biometric or genetic data used to identify a person, and health data.1
Health data is defined broadly: any personal data related to an individual’s health condition, whether physical, mental or psychological, or related to health services the individual received.1 So a claim line, an appointment record or a pharmacy refill is health data, not just a diagnosis.
The law was issued by Royal Decree M/19 and amended by Royal Decree M/148.2
What the law says about health data
Three provisions matter most for health software.
No legitimate-interest shortcut. Article 6 lists cases where processing doesn’t need consent. One is the controller’s legitimate interest, but only “provided that no Sensitive Data is to be processed.”1 For health data you need another basis, such as consent or a legal obligation.
Minimum access. Article 23 tells the Regulations to set extra controls for health data, including restricting access to health data and medical files “to the minimum number of employees or workers” and only as far as needed to provide health services, and restricting processing to the minimum staff needed for health services or insurance programs.1
Penalties for misuse. Disclosing sensitive data with intent to harm the person or for personal benefit can bring prison and fines.1 More on penalties below.
What the Implementing Regulation adds
Article 26 of the Implementing Regulation is the health data article. It asks controllers to take organisational, technical and administrative measures, and in particular:2
| Control | What Article 26 says |
|---|---|
| Sector rules | Adopt requirements from the Ministry of Health, Saudi Health Council, Saudi Central Bank and Council of Health Insurance |
| Separation of duties | Distribute tasks so specialisations don’t overlap and responsibility isn’t diffused, with different access levels |
| Records | Document all stages of health data processing and provide the means to identify the person in charge of each stage |
| Processors | Contracts with processors must bind them to the same measures |
| Minimum necessary | Limit processing to the minimum necessary for healthcare services or health insurance programs |
The records control is the one engineering teams notice. “Document all stages” and “identify the person in charge for each stage” means you should be able to say, for any processing step, who or what did it.2 A shared service account that does everything doesn’t meet that.
The reference to the Council of Health Insurance links this to claims. Insurers and providers exchanging data through NPHIES also follow CHI’s rules. Our NPHIES post covers that platform.
Consent, impact assessments and automated decisions
The Implementing Regulation has two provisions that touch AI directly.
Explicit consent. Article 11 requires explicit consent when processing involves sensitive data, credit data, or “when decisions are made solely based on automated Processing” of personal data.2 A system that decides something about a patient with no human involvement needs explicit consent unless another basis applies.
Impact assessments. Article 25 requires a written impact assessment when processing sensitive data, when linking datasets from different sources, when using newly adopted technologies, or when making decisions based on automated processing.2 The assessment covers the purpose and legal basis, the nature and scope of processing, and the risks to data subjects.
Neither article names AI, but an AI tool that reads health records or makes or drafts decisions falls under both descriptions.
Breaches: 72 hours
Article 24 of the Implementing Regulation sets the breach process:2
- Notify the competent authority within 72 hours of becoming aware of an incident that may harm the data or the data subject.
- Include the time, date and circumstances, the data categories and approximate number of people affected, and contact details.
- If information isn’t available in 72 hours, provide it as soon as possible with reasons for the delay.
- Keep copies of the reports and document corrective measures.
- Notify affected people without undue delay if the breach may harm them, in simple and clear language.
The 72-hour clock assumes you can work out what was accessed and by whom. That depends on records kept before the incident.
Penalties
The law sets two tiers.1
| Violation | Maximum penalty |
|---|---|
| Disclosing or publishing sensitive data with intent to harm or for personal benefit (Article 35) | Up to two years’ imprisonment, a fine up to SAR 3 million, or both |
| Other violations of the law or regulations (Article 36) | A warning or a fine up to SAR 5 million, which may be doubled for repeat violations |
What this means for AI tools
The PDPL doesn’t mention AI, but its health data rules apply to any software that processes health data, and a few of them fit AI tools closely:
- Minimum access applies to software too. If Article 23 limits health data to the minimum staff needed, an AI tool shouldn’t get blanket read access to every record.1
- Give each tool an identity. Article 26’s “person in charge of each stage” is easier to show when each AI tool has its own account and its actions are logged as its own.2
- Plan for explicit consent or a human decision. Fully automated decisions about a person need explicit consent under Article 11.2 Many teams keep a human approval step instead.
- Write the impact assessment before launch. Sensitive data plus automated decisions plus new technology triggers Article 25.2
Our post on audit record fields for AI actions lists what to capture, and the minimum necessary post shows how a similar US rule maps to AI tool access.
A checklist
- Treat all health-related records as sensitive data.1
- Pick a lawful basis other than legitimate interest.1
- Limit health data access to the minimum staff and tools needed.1
- Adopt the MOH, Saudi Health Council, SAMA and CHI requirements that apply to you.2
- Log every processing stage with the person or system in charge.2
- Bind processors, including AI vendors, to the same controls by contract.2
- Write an impact assessment for AI tools that touch health data.2
- Rehearse a 72-hour breach notification from your current logs.2
This post summarises the published English texts and is not legal advice. To see agent actions recorded with approvals in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.