Resolution No. 151 of 2020 approving the Law on the Protection of Personal Data ('the Data Protection Law') was published, on 17 July 2020, in the Official Gazette. In particular, the Data Protection Law applies to the processing of personal data carried out electronically, in part or in full, further providing for the processing activities to which the Data Protection Law does not apply, such as processing of data for personal use. Moreover, the Data Protection Law states that the Ministry of Information and Communication Technology will issue the Data Protection Law's executive regulations within six months from the date of implementation of the Data Protection law itself.

Furthermore, Article 2 of the Data Protection law establishes the data subject's consent as the main legal basis for the processing of personal data. The Data Protection Law also provides for data subjects' rights in relation to the processing of their personal data. In addition, Article 3 of the Data Protection Law provides for the conditions and principles that data processing must respect. Moreover, the Data Protection Law establishes the Centre for the Protection of Personal Data as the regulatory body aiming to maintain compliance with the Data Protection Law.

The Data Protection Law further addresses, among other things, the processing of sensitive personal data, cross-border data transfers, electronic direct marketing practices, and monetary penalties and criminal sanctions for violations of the Data Protection Law itself.

Lastly, the Data Protection Law will come into force three months after its publication in the Official Gazette.

You can read the Data Protection Law, only available in Arabic, here.