Balancing Privacy and Risk: A Critical Analysis of Personal Data Use as Governed by Saudi Insurance Law

The Kingdom of Saudi Arabia (KSA) Personal Data Protection Law (PDPL) was enacted in 2021. In its brief three-year existence, the PDPL has attracted significant academic and legal practitioner attention. This critical analysis focuses on three key questions: (1) What are the key PDPL objectives? (2) How does this legislation compare with privacy–data protection approaches adopted in other jurisdictions (notably the European Union General Data Protection Regulation 2016 (GDPR))? and (3) Does the PDPL achieve a reasonable, workable balance between personal data protection (‘data subjects’ interests) and risks associated with personal data being shared with KSA insurers? The analysis confirms that these PDPL measures appear sound, but a definitive assessment of the ‘balance’ objectives highlighted here requires ongoing attention—three years of PDPL use is an insufficient basis to reach final conclusions regarding PDPL fitness for purpose. However, a tentative ‘soundness’ conclusion has reasonable support when the relevant authorities are collectively assessed, particularly regarding the treatment of personal data by KSA insurers in the context of personal insurance policies.