KSA’s: Personal Data Protection Law (PDPL)

1. Overview

The Saudi Arabia Personal Data Protection Law (PDPL) was enacted in 2021 and came into effect in 2023. It tackles concerns such as the abuse of images and videos, such as deepfakes, particularly when such are produced without authorization.

2. Legal Scope

The PDPL establishes clear guidelines on how to gather, process, and transfer personal data, including biometric and visual data used to identify an individual. It also deals with the production and dissemination of deepfakes through personal data without consent. There are certain exceptions where the purposes are national security, court proceedings, or scientific studies, but these would have proper protection measures in place.

3. Mandatory Clauses

Forbidden Conduct: Article 5 clearly indicates that “processing personal data without the data subject’s consent” is prohibited. Such are instances of altering or disseminating pictures or videos purporting to be of a person.

Specific Consent Requirements: Article 6 reiterates that “the data subjects must be informed and provide explicit consent” prior to their personal data, including their image, being gathered or processed.

Platform Responsibilities: Firms should “take technical and organisational measures” to secure information and stop breaches, like removing illegal deepfakes. 

4. Sanctions & Enforcement

If a business is not sanctioned with the Personal Data Protection Law (PDPL), it may be penalized up to SAR 5 million (approximately USD 1.3 million). Offenders who are repeat offenders will be penalized even more. The Saudi Data and Artificial Intelligence Authority (SDAIA) will make sure that this law is adhered to and enforced.

5. Cases or Precedents

To date, no major public court cases have contested the PDPL itself in relation to deepfakes. Compliance guidelines were released by SDAIA and audited some entities, though. 

6. Comparison to International Standards

Though it does technically overlap somewhat with the EU’s GDPR, the PDPL is indeed far more centralized in that SDAIA oversees it. Unlike some of the laws in the U.S. states, it doesn’t yet address deepfakes but instead deals with the problem through a regulation of the misuse of personal data.

7. Practical Implications

Producers must obtain express permission to exploit the likenesses of actual people in AI-created content. Anyone can complain to SDAIA to have their likeness erased or sue for damages.

8. Future Horizons

The law will be revised with clearer provisions on AI and deepfakes. Draft revisions are under consideration to enhance transparency and align it with international best practice.