The short answer
Saudi Arabia's Personal Data Protection Law has been in force since 14 September 2023, and the compliance grace period ended on 14 September 2024. For your company's chatbot it means: tell the customer who you are and why you collect their data, collect the minimum, get clear consent where it is the legal basis, answer customer requests within 30 days, notify SDAIA of any breach within 72 hours, protect the data, and watch transfers outside the Kingdom.
Clinic and store owners in Saudi Arabia ask: “the bot collects names, numbers and appointments, is there anything legal I should watch?” Yes. Every conversation contains personal data, and the Personal Data Protection Law sets what you owe as its controller.
Since when does the law apply?
The law has been in force since 14 September 2023, and the Saudi Data and AI Authority (SDAIA) gave a one-year grace period that ended on 14 September 2024. In other words, compliance is required now.
What do you tell the customer before the chatbot collects their data?
Under the Implementing Regulation you tell them who you are, the legal basis for processing, the specific and clear purpose of collection, the retention period, their rights and how to withdraw consent. In a chatbot, a short welcome message with a link to the privacy policy covers this.
When do you need the customer's consent?
You need it when consent is the basis for processing. The regulation requires it to be given freely for each purpose separately, provable by you, and as easy to withdraw as to give. Explicit consent is required for sensitive data, including health data, and for decisions based solely on automated processing. There are other bases besides consent, such as legitimate interest for non-public entities, outside sensitive data.
For clinics: patients' appointments and symptoms are health data, which is sensitive data needing explicit consent and a written impact assessment under the regulation. Have the chatbot hand medical questions to the clinic team.
What data may the chatbot collect?
Only the minimum needed for the purpose, as the regulation states. A booking bot needs the name, number and time, not an ID number or address if the booking doesn't need them.
The Injaz AI chatbot is built on this principle: it asks only for what it needs to complete the request.
What are the customer's rights, and how do you meet them?
The customer has the right to be informed, to access their data and get a copy, to request correction, and to request destruction when it is no longer needed. You must answer within 30 days, extendable by another 30, verify their identity and document the request.
- Give the chatbot a clear path to request access, correction or deletion.
- Log every request with its date so the 30-day deadline can be tracked.
- Delete conversations whose purpose has ended, per the stated retention period.
What do you do if data is breached?
You notify SDAIA within 72 hours of becoming aware of an incident that could harm the data or its owners, through the breach-notification service on the National Data Governance Platform, and notify affected customers without undue delay in clear language. The regulation requires technical and administrative security controls, including the National Cybersecurity Authority's controls for those they apply to.
Because the Injaz AI chatbot is installed on your server, the access logs stay in your hands for any investigation.
Where are conversation data kept?
The regulation allows transfers outside the Kingdom under conditions and safeguards, such as standard contractual clauses, and requires a risk assessment in some cases. A chatbot installed on a server you choose makes compliance easier: you know where the data is, who can reach it and when it is deleted.
This is how Injaz AI by Injaz Digital builds the chatbot: on your server so conversations stay with you, with a welcome message telling the customer the purpose, collection of the minimum data, and hand-over of sensitive questions to your team.
This article is a general explanation of what SDAIA publishes, not legal advice. Check the law, its Implementing Regulation and your legal adviser for your case.
Why choose Injaz AI by Injaz Digital for your business chatbot?
- A bot that learns from your policies, products and customer questions, replies instantly in your customer's language, and knows when to hand over to a person.
- WhatsApp, Instagram, Messenger and Telegram in one inbox for your team.
- Solutions for each sector: clinics, retail, real estate, restaurants, education, hotels and salons.
- From Injaz Digital: over 15 years in the Arab market, with offices in Cairo, Dubai and Riyadh.
FAQ
Must the chatbot ask for consent in every conversation?
Not in every conversation, but the customer must be told the purpose and legal basis before collection, and consent obtained where it is the basis, for each purpose separately.
How long do I have to answer a customer's deletion request?
30 days, extendable by another 30 under the Implementing Regulation.
Within how many hours must I report a data breach?
Within 72 hours of becoming aware of it, if it could harm the data or its owners, through the National Data Governance Platform.
Is patient data in a clinic bot sensitive?
Yes. Health data is sensitive data needing explicit consent and a written impact assessment.