US firms warn Saudi Arabia new data law could hit investment

A general view of Riyadh. Saudi Arabia in September issued a draft of its personal data protection law, known as PDPL, which in its current form prevents the transfer of personal data outside the kingdom without any individual exemptions. Companies that don’t comply face criminal sanctions, according to a letter sent by the US Chamber of Commerce earlier this year and seen by Bloomberg.

The largest business lobbying group in the US has warned Saudi Arabia that a new privacy and data law will raise the cost of doing business in the kingdom and complicate efforts to attract foreign investors and wean its economy off a dependence on oil sales. Saudi Arabia in September issued a draft of its personal data protection law, known as PDPL, which in its current form prevents the transfer of personal data outside the kingdom without any individual exemptions. Companies that don’t comply face criminal sanctions, according to a letter sent by the US Chamber of Commerce earlier this year and seen by Bloomberg. “There are several aspects of this law that pose not only significant problems for the private sector but will be significant barriers to helping the Kingdom achieve its goal to become a digital hub,” the group, which represents more than 3mn businesses, said in the letter. “It will have a major impact on the cost and ability to do business in the Kingdom.” Saudi Arabia’s Crown Prince Mohamed bin Salman is looking to attract more foreign investors as part of an ambitious plan to diversify the economy away from oil. It’s vying with other financial centres in the region such as Dubai and Abu Dhabi to become the Gulf’s premier business hub. But foreign investment has remained low, and the data law is the latest example of local rules hitting international firms looking to do business in the country. The US embassy last year warned that a series of tax disputes with Saudi authorities could deter foreign firms from doing more business in the kingdom, while long-running payment issues for contractors doing business with the government have also soured attitudes. The Saudi Authority for Data and Artificial Intelligence didn’t respond to a request for comment. Tech firms, banks and payment firms are among the companies that have expressed concern about the new data law, people familiar with the matter said. The law as it is written would mean that international firms would have to duplicate all their global data handling locally. “Given the importance of this regulation, the US Chamber of Commerce appreciates the many productive and positive discussions we have organised to date with Saudi officials,” said Steve Lutes, vice president for Middle East affairs. “We look forward to continuing to engage and share our feedback and recommendations later this month on the executive regulations of Saudi’s Personal Data Protection Law.” The law may not only hurt smaller business because they face higher costs but also raises fresh cybersecurity concerns, according to the US lobby group. Providers of cloud services combat cyberattacks through a global network and if the Saudi government shuts off cloud services from outside the country, then the risk of attacks might worsen. “Data localisation requirements will impose substantial costs on all companies doing business in Saudi Arabia without increasing security,” the business group’s letter said. “Localisation will raise the cost of data storage and cloud-based services in the Kingdom and maintaining separate local servers may not be possible or practical given current network architecture.”