Guidelines for Binding Common Rules(BCR) For Personal Data Transfer

Document Classification: Public
Version 1.0
September 2024
Document Classification: Public1Document Classification: Public

2

Table of Contents

Introduction.................................................................................................................. 4
Purpose ...................................................................................................................... 4
Definitions .................................................................................................................... 5
Scope ......................................................................................................................... 7
The Geographical Scope of Binding Common Rules .......................................................... 7
Requirements for Binding Common Rules......................................................................... 7
Guidelines.................................................................................................................... 8
General guidelines......................................................................................................................................... 8
Details of the Entity Implementing the BCR ........................................................................................... 9
Description of Personal Data to Be Covered by the BCR ................................................................. 11

Appendices ................................................................................................................................. 18
Appendix 1: Documentation of Details of the Entity Implementing the Binding Common Rules......................... 18
Appendix 2: Content of the Binding Common Rules......................................................................... 24

Document Classification: Public

3Introduction
Based on the Personal Data Protection Law, issued by Royal Decree No. (M/19) dated
9/2/1443 AH (the "Law") and amended by Royal Decree No. (M/148) dated 5/9/1444
AH, and its contents on the permissibility of transferring Personal Data outside theKingdom. The Regulation on the Transfer of Personal Data Outside the Kingdom("Transfer Regulation") sets out the provisions to be followed upon transfer, including
the Rules applied in cases where Controllers are exempted from the requirements tocomply with the level of protection and the minimum level of transfer of Personal Data
stipulated in sub-paragraphs (b) and (c) of Paragraph (2) of Article (29) of the Law andprovisions of the Regulation on the Transfer of Personal Data Outside the Kingdom.

PurposeThe purpose of these rules is to ensure that a level of protection for personal data
is applied that is not less than the level of protection prescribed by the Law and its
Regulations. This is achieved by specifying obligations of the parties involved in
the transfer when personal data is transferred or disclosed to a country orinternational organization that does not have an adequate level of protection for
personal data. This document provides comprehensive instructions for a range ofentities operating within and outside the Kingdom regarding the preparation of
Binding Common Rules. Binding Common Rules are considered one of theappropriate safeguards that data controllers may use, in addition to processors
acting on behalf of and based on the instructions of the data controller. They arealso used alongside standard contractual clauses and certifications from an entity
licensed by the competent authority, in accordance with the provisions governing
the transfer of personal data outside the Kingdom.

Document Classification: Public

4

Definitions
The following terms and phrases, wherever stated in these clauses, shallhave the meanings assigned to each of them unless the context indicatesotherwise:

The Kingdom: The Kingdom of Saudi Arabia (KSA).
The Law: The Personal Data Protection Law (PDPL) issued by Royal Decree No.
(M/19) dated 9/2/1443 AH ("The Law") and amended by Royal Decree No. (M/148)
dated 5/9/1444 AH.

Regulations: The "Implementing Regulations of the Law", including both the“Implementing Regulations" and the Regulations for the Transfer of Personal Data
Outside the Kingdom.

The Competent Authority: Saudi Data & AI Authority (SDAIA).

Appropriate Safeguards: The requirements imposed by the competentauthority on controllers, which include adherence to the Law and Regulations
when transferring or disclosing personal data to entities outside the Kingdom. Thisapplies in cases where exemptions are granted from the conditions for providing
an appropriate or minimum level of personal data protection, to ensure
appropriate level of protection when transferring personal data outside theKingdom that meets at least the standards prescribed by the Law andRegulations.

Binding Common Rules (BCR): Rules established by the controller,
applicable to each controller and processing party within a group of multinational

Document Classification: Public

5entities, ensure appropriate protection for personal data transferred outside theKingdom at a level not less than that prescribed by the Law and Regulations.

International Organizations: A legal body comprising members from at least
three countries, operating in multiple sovereign states, established through aformal legal document such as a treaty or agreement based on international law,and this legal document defines the aims and objectives of the internationalorganization and its structures, decision-making powers and jurisdiction. (e.g., theUnited Nations, the World Bank, the League of Arab States, the Arab MonetaryFund). These organizations engage in international activities and must comply withvarious Personal Data protection laws across different jurisdictions.

Transfer of Personal Data: Transfer, disclosure (or granting of access) of
Personal Data from the Kingdom of Saudi Arabia to Controllers, Processors, orother recipients in countries or international organizations other than the Kingdomof Saudi Arabia where neither the Personal Data Exporter nor the Personal
Importer is a Data Subject.

Third Party Data Transfers/Subsequent Transfers: The transfer of
Personal Data from an external country or international organization to Controllers
or Processors within the same country/organization or in another country/
organization.

Group of Entities: A set of legal entities engaged in joint economic activities
such as franchising, joint ventures, or professional partnerships. These entities

operate under shared control for example, ownership, common economic
interests, financial participation, or the governance rules.

Document Classification: Public

6ScopeThis document specifies the requirements and guidelines related to Binding
Common Rules. It applies to data controllers or processors based on the
instructions of the data controller and on their behalf, without prejudicing the
responsibilities of the data controller to the competent authority or the data
subject, as applicable, when transferring personal data outside the Kingdom to a
country or international organization that does not have an appropriate level of
Personal Data protection.

The Geographical Scope of Binding Common Rules
The geographical scope of the Binding Common Rules includes all Personal Datatransfers made by Controllers located within the Kingdom to any country/

organization outside the Kingdom.

Requirements for Binding Common Rules
1. The Group of Entities must ensure that the Binding Common Rules (BCR)
include Controllers' obligations stipulated in the PDPL and Regulations, inaddition to the rights of Data Subjects, including claiming compensation fordamage resulting from violation of such rights.
2. The Group of Entities, including the Personal Data Importer, must cooperatewith the competent authority, comply with all its requests and inquiries, andprovide the necessary documents and information to ensure adherence to the
Binding Common Rules.
3. BCR must be approved internally by the authorized person within the Group of
Entities. This process includes reviewing and validating all the data protection
measures and compliance mechanisms to be taken regarding Personal Data
protection.
Document Classification: Public

7

4. BCR shall be legally enforceable on every member of the Group of Entities andprovide a consistent standard of data protection. Every member of the Groupof Entities that receives the relevant Personal Data must comply with theprovisions set out in the Law and Regulations.
5. In addition to the BCR, detailed policies shall be developed on data protection,
Data Subject rights, security measures, audit programs, and mechanisms forhandling data breach incident and complaints in compliance with the Law andRegulations.
6. Binding Common Rules are subject to the laws in force in the Kingdom, andany dispute arising from application of the rules shall fall under jurisdiction of
the courts of the Kingdom. The Personal Data Importer/s within the group ofentities agree to submit to jurisdiction of the Kingdom.

Guidelines
General guidelines
1. Parties to a binding agreement shall ensure that none of its provisions conflictwith the Binding Common Rules (BCR) or limit their scope of application.
2. The Controller must provide the competent authority, upon request, withevidence of its compliance with the Binding Common Rules, Law, andRegulations.
3. The Controller must establish an effective prompt incident response plan toaddress personal data breach incident, damage, or unauthorized access.
4. The Binding Common Rules must include procedures for notifying thecompetent authority and data subjects upon discovering a data breach that
could harm the transferred personal data or the data subjects, or that conflicts
with their rights or interests.
Document Classification: Public8

5. Updates to the list of members under the Binding Common Rules may be madeunder the following conditions:a. Maintaining an updated record of members of the Binding Common Rules, dataprocessors, and sub-processors involved in personal data processing activities,
and facilitating data subjects' access to the list of members of the Binding
Common Rules.
b. Keeping a report that explains the reasons for the updates or changes tomembers' record.
6. The exemption status under the Binding Common Rules does not apply if theData Controller fails to implement them, or if the competent authority finds theminadequate.

Details of the Entity Implementing the BCR
FIRST SECTION
This section should be used to document details about the entity within theGroup of Entities that is implementing the Binding Common Rules (BCR).
1. Name of the Group: Provide the official name of the Group of Entities, forexample: "**** Group".
2. Address of the Headquarters of the Group: Specify the complete address ofthe main headquarters of the Group of Entities, for example: "123 Main Street,
Riyadh, Saudi Arabia".
3. Name of the Entity: State the name of the entity within the Kingdom of Saudi

Arabia responsible for the BCR, according to the commercial registration
number of that entity, and confirm that such entity has the financial capability
to provide compensations for any liabilities under the BCR, for example: "******
Company".
Document Classification: Public

94. Legal Form of the Entity: Indicate the legal form of the entity, for example:"Corporation ".
5. Commercial Registration Number of the Entity: Provide the commercial
registration number assigned to the entity by the relevant Saudi Arabianauthority, for example: "123******"
6. Address of the Entity in the KSA: Enter the full address of the entity within theKingdom of Saudi Arabia, for example: "457 Industrial Zone, Jeddah, Saudi
Arabia".

7. Registration Number of the Entity at the Competent Authority: Provide theregistration number assigned by the Competent Authority if available, forexample: "987754321"
8. Business Sector of the Entity: Specify the business sector in which the entity
operates, for example: "Information Technology"
9. Name, Address, and Commercial Registration Number of All Entities of theGroup Inside the Kingdom: List all entities within the Group located in Saudi
Arabia, along with their addresses and commercial registration numbers, forexample: "**** Riyadh, 789 Commerce St, Riyadh, CR No.112233", "****
Jeddah, 457 Trade Rd, Jeddah, CR No. 44****".
10. Position of the Entity Within the Group: Describe the role or position of theentity within the Group of Entities structure worldwide, for example: "Regional
Headquarters for the Middle East".
11. Name and Position of )the Person in Charge of the BCR(: Provide the full nameand job title of the individual responsible for managing the BCR, for example:"Abdulrahman, Personal Data Protection Officer".

Document Classification: Public1012. Contact Details of Person (Point of Contact) - (Address, Email, Phone Number):Enter the contact details for the point of contact, including their address, email,and phone number, for example: "789 Compliance Blvd, Riyadh, Saudi Arabia,
Abdulrahman @example.com, +966-000-000***".
13. Name, Title, and Full Contact Details of Any Representative(s) Instructed to Act
on Behalf of the Entity: Provide the details of any external legal or advisory
professionals assisting with the BCR documentation, if any, for example:"Amal, Senior Counsel, Legal Advisors, Amal@example.com, +966-000-00****”
14. Additional Documents to Be Provided as an Annex: Include a detailed chart

illustrating the organizational structure and geographical location of all Group
members bound by the BCR.

Description and Details to Be Covered by the BCR

SECOND SECTION
1. Type or Categories of Personal Data to be Transferred and Covered by the BCR:
Specify the types or categories of Personal Data that will be transferred underthe BCR. This shall include a clear description of the data types.
2. Categories of Data Subjects Whose Personal Data to Be Transferred: Identify
the categories of Data Subjects whose Personal Data will be transferred inaddition to those affected by the transfer.
3. Purposes of Transferring Personal Data: Clearly state the reasons fortransferring Personal Data outside the Kingdom. Explain the processing
activities that will occur after the data has been transferred.

Document Classification: Public11

4. Countries to Which Personal Data to Be Transferred: List all the countries towhich Personal Data will be transferred under the BCR. Ensure each country is
specified accurately.
5. Frequency of Transfer: Indicate how often Personal Data will be transferred.
Choose from "One-Off," "Continuous," or "Periodic," and provide further details
if necessary.
6. Contractual Arrangements: Detail Any Contractual Arrangements Regarding theUse of Controllers and their contracted Processors along with their Complianceto the BCR.
7. Additional Documents to Be Provided as an Annex: List the additional
documents that should be included as annexes to provide further clarity andsupport for the BCR.

Binding Nature of the BCR
1. Binding Characteristics of the BCR: Demonstrate and specify how the BCR are
to be made binding on the members of the Group: Intra-Group Agreements: Describe the legally binding agreements within
the Group that enforce the BCR. Include details on how these agreements
are formulated and signed by all relevant entities.

 Undertakings by the Parent Company: Explain any undertakings imposedby the parent company on the members of the Group.
 Binding Requirements: Outline the specific binding requirements that theGroup members shall be burdened with. Provide references to internal
documents or legal provisions that enforce these requirements.
Controllers have the right to enforce the BCR against any BCR member for
any violation of the agreed-upon texts. All BCR members have agreed tothis provision as part of their commitments.
Document Classification: Public

12

2. Enforcement by Members of the Group: Describe the enforcement

mechanisms available

to Group members within the Kingdom andinternationally. Include any specific procedures for reporting and addressing
non-compliance.
Example: The BCR can be enforced by any member of the Group throughestablished internal reporting mechanisms and compliance programs.
Members established in the Kingdom have specific procedures to escalate
issues to the Group’s Data Protection Officer, who coordinates with theCompetent Authority to ensure enforcement.
3. Binding upon Employees: Explain how the BCR will be made binding upon theemployees of the Group members.
 Employment Contract: Describe how BCR obligations are included in
employment contracts.
 Company Policies: Explain how the BCR texts are included in relevant
company policies.

 Disciplinary Sanctions: Provide details on disciplinary measures for noncompliance with BCR.
4. Obligations on Sub-Processors: Describe the contractual obligations imposedon Sub- Processors, including the measures taken for non-compliance
5. Third-Party Beneficiary Rights: Describe the measures taken to enable Data
Subjects to practice their rights and seek redress. Include details on how theserights are respected and how Data Subjects can seek redress in case of violationof their rights
6. Transparency in Regard to BCR: Describe the communication means andchannels used to make the BCR accessible to Personal Data Subjects. Include

Document Classification: Public

13

details on channels available for Personal Data Subjects, such as websites orother accessible platforms.
7. Awareness and Training: Describe how employees of the Group members willbe trained for compliance with and be made aware of the obligations andrequirements set out in the BCR. The training program must ensure that all
employees understand their responsibilities and the Personal Data Protection
requirements stipulated in the Law and Regulations.
8. Complaint Handling: Describe the mechanisms that will be implemented toensure efficient handling of complaints regarding the BCR and related transfers
outside the Kingdom. It should be made clear that Personal Data Subjects caneasily submit complaints and that these complaints are addressed promptly andeffectively.
9. Auditing Process: Describe the auditing process that will be implemented toensure compliance with the BCR by each member of the Group. It should
include sufficient information on the audits.

Cooperation with the Competent Authority
This section outlines the principles and procedures for cooperation between theGroup of Entities and the Competent Authority. It ensures that the Group

complies with the requirements set by the Competent Authority, facilitating
effective oversight and ensuring adherence to the BCR, laws and regulations
applicable in the Kingdom.
1. Cooperation with the compete authority: Explain the general principles andobligations of the Group of Entities in cooperating with the Competent Authority.
It emphasizes the Group members commitment to transparency, responsivenessand collaboration in all matters related to data protection, including the following:
Document Classification: Public

14•

Provide a statement affirming the Group’s commitment to cooperate

fully with the Competent Authority.
•

Identify the designated contact point within the Group who will handle

requests from the Competent Authority, and include the roles and contact
information.
•

Outline the procedures for responding to requests, inquiries, andinspections from the Competent Authority. Specify the timelines forproviding information and documentation.

Describe any regular reporting obligations to the Competent Authority,

including the types of reports and content.
2. Compliance with the Competent Authority Directives: Describe how the Groupand its members will comply with the Competent Authority’s directives
regarding the BCR and the processing of Personal Data.
3. The Right of the Competent Authority to Follow up on Compliance: Describe
how the Competent Authority can follow up on Groups’ compliance with the

BCR and provisions of the Law and Regulations.

Personal Data Protection Measures
Detailed explanations on how data protection measures are taken through the

Binding Common Rules (BCR). Supporting documents and references relevant to
the BCR must be provided.
Appointment of Personal Data Protection Officer(s): Detail the process forappointing Data Protection Officers (DPOs) responsible for overseeing dataprotection

compliance.

Includethecriteria

forselection,

roles,

andresponsibilities in accordance with provisions of the Law and Regulations.

Document Classification: Public

15

Cooperation among the network of Personal Data Protection Officer(s) within theGroup: Describe how DPOs within the Group cooperate to ensure consistent
Personal Data Protection practices.
Roles and Responsibilities of the individuals involved and their cooperation with
the network of Personal Data Protection Officer(s) within the Group: Define theroles and responsibilities of Personal Data Protection officers and theirinteraction with relevant individuals.
Requirements for Transparency: Specify the measures taken to ensuretransparency in Personal Data processing activities conducted by the entity
without prejudice to the Law and Regulations.
Requirements for Personal Data Processing: Describe how Personal Data isprocessed while ensuring compliance with the BCR in accordance with the Law
and Regulations.
Requirements for Purpose Limitation and Legal Basis: Detail how personal dataprocessing is limited to specific, legitimate purposes in accordance with a legal
basis and in compliance with provisions of the Law and Regulations.
Requirements for Minimum Amount of Personal Data: Outline measures taken to

ensure only the minimum necessary Personal Data is collected and processed incompliance with provisions of the Law and Regulations.
Personal Data Retention and Deletion Periods in accordance with provisions of

the Law and Regulations, along with an explanation of data retention anddestruction policies.

Document Classification: Public

16Requirements for Sensitive Data (as the case may be): Describe additional

measures taken while processing Sensitive Data in compliance with provisionsof the Law and Regulations.
Requirements for Maintaining Records of Personal Data Processing Activities:
Describe how records of Personal Data processing activities are maintained incompliance with provisions of the Law and Regulations.
Requirements for Impact Assessment: Explain the procedures for conducting
data protection impact assessments (DPIAs) in compliance with provisions of the
Law and Regulations.
Requirements for Personal Data Quality: Describe measures taken to ensure data
accuracy and quality in compliance with provisions of the Law and Regulations.
Requirements for Personal Data Security: Describe the security measures in place
to protect Personal Data in compliance with provisions of the Law andRegulations.
Requirements for Personal Data Breach Incident Notifications: Describe theprocedures and measures taken for notifying Personal Data breach incidents incompliance with provisions of the Law and Regulations.
Restrictions Regarding Subsequent Transfers: Describe the restrictions ontransferring Personal Data to third parties in compliance with provisions of the.Law and Regulations.
Requirements for Conducting Transfer Impact Assessment: Describe theprocedures for assessing the impact of Personal Data transfers in compliancewith provisions of the Law and Regulations.

Document Classification: Public

17

Appendices
Appendix 1: Documentation of Details of the Entity
Implementing the Binding Common Rulesa. Instructions• When required, an electronic copy of the BCR will be provided to the Competent

Authority. Additional documents can be attached as appropriate.
• Additional documents are included in the last section of the application form.

b. Entity Information
Entity Details
1.

Name of the group]Please enter[2.

Address of the headquarters]Please enter[of the group

3.

Name of the entity[Please enter]

4.

Legal form of the entity[Please enter]

5.

Commercial registration[Please enter]

number of the entity
6.

Address of the entity in the[Please enter]kingdom of Saudi Arabia
7.

The registration number of[Please enter]the entity with the Competent
Authority, if applicable:
8.

Activity of the entity

Document Classification: Public[Please enter]

18

9.

Name, address, and[Please enter]

commercial registration
number of all entities of theGroup in the Kingdom of
Saudi Arabia:

10. Position of the entity within the[Please enter]

group
11. Point of contact name

[Please enter](Personal Data protection
Officer)
12. Contact details of the point ofcontact(Personal[Please enter]

Data

protection Officer) (address,
email, phone number)
13. Name, title, and full contact[Please enter]details of any external lawyers

or other advisors instructed toact on behalf of the entity, if
applicable
14. Additional documents to beGroup Structure Chart: A description of the corporate

provided within the

structure and geographical location of all members of theattachments.

Group to be bound by the BCR.

Description and Details of Personal Data Flows Covered by the Binding Common

Rules
.1

The Type or Categories of[Please enter]

Personal Data to Be
Transferred

Document Classification: Public

19

2.

Categories of Data Subjects[Please enter]

Whose Personal Data to Be
Transferred
3.

Purposes of Transferring[Please enter]

Personal Data
4.

Countries to Which Personal[Please enter]

Data to Be Transferred5.

Frequency of Transfers[Please enter]6.

Detail any contractual[Please enter]arrangements regarding theuse of Processors and theircompliance to the BCR
7.

Additional documents to be[Please enter]

provided as an appendix.

The Binding Nature of the Binding Common Rules
1.

The Necessary Nature of the[Identify and clarify how the BCR are binding to the Group

BCR

members, e.g. the BCR are binding for all Group
members,

agreements

withintheGroup,

andundertakings imposed by the parent company on themembers of the Group] [Explain and specify how the BCR
ensure that the Controller(s) have the right to enforce the
BCR against any member for the violation it has caused of
the Binding Common Rules.
2.

Enforcement by Members of[Clarify how members of the Group can enforce thethe Group

Binding Common Rules]

Document Classification: Public

20

3.

Binding upon Employees[Please explain how the Binding Common Rules will bemade binding upon the employees of Group members.
e.g. employment contracts, incorporation of Binding
Common

Rules

into

relevant

company

policies,

disciplinary sanctions. Please list excerpts from policies or
confidentiality agreements as appropriate to explain how
employees are bound by the Binding Common Rules]
4.

Obligations on[Please explain how the Group ensures that the

Sub-Processors

involvement of Sub-Processors will not undermine thelevel of protection guaranteed under the Binding Common
Rules. For example, obligations contained in agreementswith them and contractual penalties imposed on
subcontractors for non-compliance...]5.

Third-Party Beneficiary Rights[Please explain how the BCR will ensure that Personal
Data Subjects are able to exercise their rights under the
Law and Regulations]

6.

Transparency in Regard to[Please explain how the material content of the BCR will

BCR

be communicated to Data Subjects or made available andaccessible to Personal Data Subjects]

Effectiveness of the Binding Common Rules
1.

Awareness and Training[Explain how the employees of the Group members will be
trained for compliance with and be made aware of theobligations and requirements set out in the BCR]

2.

Complaint Handling[Describe the mechanisms to be implemented to ensure
efficient handling of complaints relating to the BCR andrelated transfers]

Document Classification: Public

21

3.

Auditing Process[Describe the audit to be conducted to ensure that eachGroup member adheres to the BCR]

Cooperation with the Competent Authority
1.

2.

Cooperation with the[Clarify how the BCR cover the subject of cooperation with

Competent Authority

the Competent Authority]

Compliance with the[Explain how the Binding Common Rules ensure that theCompetent Authority

Group as a whole and the Group members will comply

Directives

with the guidance and correspondence issued by theCompetent Authority regarding the Binding Common
Rules and the related processing of Personal Data]

3.

Right of the Competent[Clarify how the BCR will enable the Competent Authority

Authority to follow up on

to follow up on the Group and the Group members’

compliancecompliance with the BCR]

Data Protection Measures
Explain how each of the following requirements is addressed under the BCR, provide reference
to the relevant section of the BCR, and provide supporting documentation, where appropriate.
Appointment of Personal Data
Protection Officer(s)Cooperation between
Internal/External Personal Data
Protection Officers working within

the Group?
Requirements for Transparency
Requirements for Personal Data
Processing

Document Classification: Public

22Requirements for Purpose
Limitation
Requirements for Minimum
Amount of Personal Data
Personal Data Retention, Deletionand Destruction Periods
Requirements for Sensitive Data
(as the case may be)

Requirements for Maintaining
Records of Personal Data
Processing Activities
Requirements for Impact
Assessment
Requirements for Personal Data
Quality
Requirements for Personal Data
Security
Requirements for Personal Data
Breach Notification
Restrictions Regarding
Subsequent Transfers
Requirements for Conducting
Transfer Impact Assessment

Requirements for Conducting Transfer Impact Assessment[Please enter any other relevant information]

Document Classification: Public

23

Other Comments
Copy of official Binding Common Rules[please enter][please enter]

Appendix 2: Content of Binding Common Rules
The Binding Common Rules must also specify (data transfers or set of transfers),
including the categories of Personal Data, the type of processing and its purposes,
the types of Data Subjects, and the organization/country). For each clause on the

BCR, include a description of the provision(s)/ sections of the BCR that address
the relevant elements
1.

The name of the Group and the addressof its headquarters.

2.

The

name

of

the

Group

member(delegated with Personal Data protection)in the Kingdom, and address of Group
Member in the Kingdom.
3.

Commercial registration information for
the Group of Entities

4.

Details about organizational structure andcontact details of the Group of Entities
and each of its members (in particular, aDocument Classification: Public

24list of the entities that shall be bound by
the BCR).

5.

Description of Personal Data transfers or
the set of BCR transfers:

Type or categories of Personal Data
6.

Subjects whose Personal Data are beingtransferred;

categories of Data Subjects
whose Personal Data are beingtransferred;

The purpose of transfer of

Personal Data;

Location of transfer (or expectedpurposes of processing);

Proposed transfer duration

Other Comments
1.

The binding nature of the BCR The BCR
must be legally binding on every memberof the Group, and they must make it clearthat every member of the Group thatreceives the relevant Personal Data mustcomply with the provisions set out in the
Law and Regulations. The same applies
to employees and subcontractors ofDocument Classification: Public

25

Group members, who must respect the
BCR.

Relevant Sections of the BCR
2.

Rights of Personal Data Subjects

The Group members must include theData Subjects rights in the BCR alongwith the mechanism of exercising thoserights under the Law and Regulations,
including (but not limited to the following):•

The right to obtain information

regarding the legal reason andpurpose for collecting andprocessing Personal Data.
•The right to access Personal Data.
•The right to request a copy of the
Personal Data in a clear, legible
format.
•The right to request correction of
Personal Data.
•The right to destroy Personal Data..
The BCR are required to: (1) ensure
the prevention of any negative impact
on the rights of Data Subjects under
the Law and Regulations due to thetransfer of data abroad; (2) Grant Data
Subjects the right to file complaints
before the Competent Authority andspecify the compensation mechanism

Document Classification: Public26

in the event of any violation of one ofthe provisions of BCR.

Relevant Sections of the BCR
3.

Responsibilities and Liability
The BCR must contain clear obligations
for

the

Group

(delegated

or

with

Group
data

memberprotection

responsibilities) in the Kingdom, as theGroup is responsible and liable to Data
Subjects and/or the Competent Authority
for any violations of the BCR committed
by other Group members outside theKingdom.
Mechanism for dealing with Personal
Data breach incidents.

Relevant Sections of the BCR
4.

Jurisdiction
The BCR must include a provision thatclaims for violations of the BCR are
subject to the courts of the Kingdom andshall be addressed in accordance withthe regulations in force in the Kingdom,
and that the Data Subjects can filecomplaints to the Competent Authority
against the Group member (delegatedwith data protection responsibilities) thatis established in the Kingdom, even if theDocument Classification: Public

27

violation was committed by a Group
member from outside the Kingdom.

Relevant Sections of the BCR
5.

Transparency
The BCR must include the obligation ofGroup members to provide Data Subjects
with the material content of the BCR.

Effectiveness of the Binding Common Rules
1.

Awareness and Training
Employees of Group members involved in
the processing of Personal Data/Sensitive
Data must be made aware of theobligations and requirements set out inthe BCR and must receive appropriate
training.

The

BCR

shouldinclude.commitments in this regard

Relevant Sections of the BCR
2.

Complaints Handling
The BCR should specify a mechanism for
dealing with complaints from Personal
Data Subjects and how to submit them.
The Rules must impose that mechanism
on Group members.

Document Classification: Public

28

3.

Audit Process
The Group must conduct audits and takecorrective actions to ensure compliancewith the BCR. Licensed external auditors
may be used to conduct audits. The BCR
must include a description of the audit
process and the commitment of Group
members

to

the

audit

process

accordingly.
The BCR must state that the Competent
Authority can obtain the results of theaudit upon request.

Relevant Sections of the BCR
4.

Supervision
The BCR shall require the Group to
appoint a Personal Data Protection
Officer/s, where applicable, a network of
Personal Data Protection Officers or ateam of experts across the Group to
assume responsibility for overseeing
compliance with the BCR. The BCR shall
include details and descriptions of theteam structure and tasks.

Relevant Sections of the BCR
5.

Accountability

Document Classification: Public

29

The BCR must make it clear that eachmember of the Group can demonstrate its
compliance with the BCR along with theapplication of the provisions of the Law
and Regulations, including, specifying the
purpose of processing, the minimum
amount of Personal Data required, theretention period, the legal reason forprocessing, the controls for processing
Personal Data, and the requirements
related to subsequent transfers to otherparties that are not bound by the rules.

Cooperation with the Competent Authority
1.

Relationship with the Competent Authority
All members of the Group must be
committed

tocooperating

with

the

Competent Authority in accordance with
the BCR and related processing activities.
The BCR must also stipulate that theGroupmembers

adheretotheinstructions of the Competent Authority,
in addition to allowing it to audit theGroup’s compliance with the BCR

Relevant Sections of the BCR
2.

Conflict of National Legislation
The Binding Common Rules must requireGroup Members to immediately notify thecompetent authority if any statutory

Document Classification: Public

30

provision of a country outside theKingdom could negatively impact thebinding common rules or compliance
therewith.
3.

Personal Data Protection Requirements

Group members in BCR must adhere toprovisions of the Law and Regulations.
The BCR must include the provisions
stipulated in the Law and Regulations asfollows:•Transparency;•Lawfulness of processing;•Purpose Limitation;•Minimum Amount of Personal Data;•Storage Limitation;•Additional protection of Sensitive Data
(where applicable)•Requirements for conducting Impact
Assessments;• Personal Data Security;• Personal Data Breach Notification;• Restrictions regarding subsequent
personal data transfers to parties notbound by the rules and;• Requirements for conducting risk
assessments for transferring Personal
Data outside the Kingdom.

Document Classification: Public31Document Classification: Public

32