Just In Time Privacy Notice Template for Saudi Arabia

A Just In Time Privacy Notice is a specialized legal document required under Saudi Arabia's Personal Data Protection Law (PDPL) that provides real-time privacy information to individuals at the exact moment their personal data is being collected. Unlike general privacy policies, this notice delivers contextual, specific information about particular data collection activities, ensuring transparency and compliance with Saudi regulatory requirements.

When do you need this document?

You need a Just In Time Privacy Notice whenever you collect personal data from individuals in Saudi Arabia, particularly in digital environments. This includes when users fill out online forms, create accounts on your platform, subscribe to services, or interact with digital touchpoints where data collection occurs. The notice is especially critical for e-commerce platforms, mobile applications, website registration processes, and any automated data collection systems. Under the PDPL, data controllers must provide this information at the point of collection, not after the fact, making this document essential for maintaining legal compliance in Saudi Arabia's evolving digital landscape.

Key legal considerations

Your Just In Time Privacy Notice must clearly identify the specific data being collected and the legal basis for collection under Saudi PDPL. The document should specify whether you're collecting data based on consent, legitimate interest, contractual necessity, or other lawful grounds recognized by Saudi law. You must clearly state the purpose of data collection, how the information will be used, and any automated decision-making processes involved. The notice should also address data retention periods, explaining how long you'll keep the collected information and the criteria used to determine these timeframes. Additionally, you must inform data subjects of their rights under PDPL, including the right to access, correct, delete, or port their data, and provide clear instructions on how to exercise these rights.

Legal requirements in Saudi Arabia

Under Saudi Arabia's PDPL and implementing regulations, your Just In Time Privacy Notice must be provided in Arabic, though bilingual notices are acceptable for international operations. The notice must be easily accessible and understandable, avoiding complex legal language that might confuse data subjects. You're required to specify any cross-border data transfers and the safeguards in place to protect transferred data, particularly important given Saudi Arabia's data localization requirements under the Cloud Computing Regulatory Framework. The document must identify your organization as the data controller, provide contact details for your Data Protection Officer if applicable, and explain how individuals can file complaints with the Saudi Data & Artificial Intelligence Authority (SDAIA). The notice should also address any third-party data sharing arrangements and ensure compliance with sector-specific regulations that may apply to your industry or data processing activities.