Applicant Privacy Notice Template for Saudi Arabia

An Applicant Privacy Notice is a crucial legal document that organizations in Saudi Arabia must provide to job candidates when collecting their personal data during recruitment. This notice serves as a transparency tool that explains your data processing activities and ensures compliance with the Personal Data Protection Law (PDPL), which became effective in 2023. You need this document to meet your legal obligations as a data controller and to build trust with potential employees by demonstrating your commitment to protecting their privacy rights.

When do you need this document?

You must provide an Applicant Privacy Notice before or at the time of collecting any personal data from job applicants. This includes when candidates submit applications through your website, email, or in-person interviews. The notice is required whether you collect basic contact information or comprehensive background details including educational qualifications, employment history, and references. You also need this document when working with recruitment agencies or third-party background check providers, as you remain responsible for ensuring applicants understand how their data will be processed throughout the entire recruitment chain.

Key legal considerations

Your privacy notice must clearly explain the legal basis for processing personal data, which under Saudi law typically includes performance of a contract (for the recruitment process) or legitimate interests (for maintaining candidate records). You must specify what personal data you collect, including mandatory information like contact details and qualifications, as well as voluntary information such as diversity data. The document should outline data retention periods, typically ranging from six months to two years depending on whether the candidate is successful. You must also address data subject rights under the PDPL, including access, rectification, erasure, and portability rights, along with clear procedures for exercising these rights.

Legal requirements in Saudi Arabia

Under the PDPL and its implementing regulations, your privacy notice must be written in clear, accessible language and be easily available to applicants. You must obtain explicit consent for processing sensitive personal data categories such as health information or criminal background checks. The notice must address cross-border data transfers if you share applicant data with international offices or service providers, ensuring adequate protection measures are in place. You are required to appoint a Data Protection Officer if you process large volumes of personal data or handle sensitive categories regularly. The notice must also include contact information for your data protection representative and explain how applicants can file complaints with the Saudi Data and Artificial Intelligence Authority (SDAIA) if they have concerns about your data processing practices.