Every hiring project collects a large amount of data: résumés, phone numbers, test results, interview recordings, and assessment notes. All of this is personal data governed in the Kingdom by the Personal Data Protection Law. Protecting candidate data is no longer a technical matter for the IT department alone; it has become a legal obligation that falls on HR, recruitment teams, and the vendors who work with them. In this article we explain what hiring organizations must do when collecting, processing, and storing candidate data, and how to build practices that protect candidates and protect the organization from violations.
Note: This article is general information for awareness and is not legal advice. You should review the official text of the law and its implementing regulations and consult a legal specialist when applying them to your situation.
What is the Personal Data Protection Law in the Kingdom?
About the law
The Personal Data Protection Law is the first comprehensive law for protecting personal data in the Kingdom. It was amended in 2023 and is complemented by implementing regulations and a regulation on transferring data outside the Kingdom, along with guidelines and rules issued by the competent authority.
The competent authority
The Saudi Data and Artificial Intelligence Authority (SDAIA) oversees enforcement of the law and has the power to receive complaints and issue warnings and administrative fines.
Who does the law apply to?
• Any entity that processes personal data inside the Kingdom, whether a large or small company or a government body.
• Entities outside the Kingdom that process data of individuals residing in the Kingdom, depending on the scope of the law.
• Recruitment and assessment service providers that process candidate data on behalf of companies.
Effective dates and enforcement
The law came into force on 14 September 2023, and entities were given a grace period to bring themselves into compliance, which ended on 14 September 2024; since then the law has been fully enforceable. In other words, the “preparation” phase is over, and entities are now required to comply.
What candidate data does the law cover?
General personal data
• Name, mobile number, email address, and home address.
• Résumé, qualifications, and previous experience.
• Personal photo and copies of documents attached to the application.
Test and assessment results
• Scores on aptitude tests, psychological tests, and personality reports.
• Assessor notes and interview scores.
• Results of simulation exercises and assessment centers.
These results are practically sensitive, because they affect the candidate’s job prospects, and they should be handled with greater care than ordinary data.
Interview and test recordings
• Audio and video recordings of recorded interviews.
• Screen and camera captures in remotely proctored tests.
• Images of identity documents used for verification.
Sensitive data
The law treats certain categories of data with greater caution, such as health data, genetic data, biometric data, religious beliefs, ethnic origin, and criminal records. Some of the most important practical rules here are:
• Do not ask the candidate for anything you do not actually need for the job; this lowers your risk before it is even a legal obligation.
• If you need sensitive data, such as medical fitness for a particular job, define the justification and apply stricter controls.
• Store it in a separate, protected location and limit the number of people who can access it.
Who is responsible: the controller and the processor
The controller
This is the entity that determines the purpose and means of processing the data. In hiring, it is usually the company that advertises the job and decides on candidates.
The processor
This is the entity that processes data on behalf of the controller, such as a recruitment platform or an online testing provider.
Why does this distinction matter?
• The controller remains responsible for compliance even if it uses an external provider.
• There should be written contracts that specify what the provider may and may not do with the data.
• The organization should vet its providers and verify their compliance periodically.
Obligations of hiring organizations when collecting candidate data
Consent and the legal basis for processing
Consent is the main basis for processing data under the law, with exceptions set out in the law and its regulations.
• Make consent clear, freely given, and specific to a purpose, not buried in long terms and conditions.
• Keep evidence of each candidate’s consent, such as an electronic form recorded with the date.
• Let the candidate withdraw consent in a simple way, and explain how this affects their application.
• Ask for separate consent for any additional use, such as keeping the résumé for future opportunities.
Transparency and the privacy notice
Before collecting data, tell the candidate the following in a short, clear privacy notice:
• What data is collected and why.
• Who has access to it inside and outside the company.
• How long it will be kept.
• Their rights and how to exercise them.
• How to contact the responsible party.
Purpose limitation and data minimization
• Collect only what you actually need for hiring.
• Do not use the data for a purpose different from the one disclosed to the candidate without new consent or a legal basis.
• Avoid application forms that ask for many unnecessary fields, such as an ID number before you reach a stage that requires it.
Accuracy and currency of data
The controller must verify that candidate data is accurate, complete, and relevant before processing it.
• Give the candidate a way to update and correct their data.
• Do not rely on outdated data for new decisions without reviewing it.
• Correct errors in candidate files as soon as they are discovered.
Retention period and destruction
Candidate data may not be kept longer than the purpose for which it was collected requires, and once the purpose has ended the data should be destroyed or anonymized, as permitted by the regulations.
• Set a stated retention period for the files of unsuccessful candidates, with a clear justification.
• Do not keep résumés indefinitely on the pretext of future opportunities, except with the candidate’s explicit consent.
• Carry out actual, documented destruction of data when the period ends, including backups.
• Review other regulations that may impose minimum retention periods for certain records.
Data security
The controller is required to take appropriate technical and organizational measures to protect candidate data from unauthorized access, loss, or leakage.
• Restrict access to candidate files to those who actually need it.
• Use strong passwords and multi-factor authentication for recruitment systems.
• Encrypt data at rest and in transit.
• Do not send candidate files over insecure channels, such as public messaging groups.
• Train the hiring team in safe data handling.
Record of processing activities
The regulations require controllers to keep a record of data processing activities, including the purpose of processing, the categories of data, and the parties who access it. The record is kept for a period set by the regulations, which some legal sources say is no less than five years from the end of the activity.
• Document every activity involving candidate data, from recruitment through data retention.
• Update the record when a new tool or new provider is added.
Impact assessment and the data protection officer
• The regulations require a documented impact assessment in certain cases, including the processing of sensitive data and the use of new technologies.
• They require the appointment of a data protection officer in specific cases set out in the regulations and the competent authority’s rules.
• Even where appointment is not mandatory, it is best to designate a person responsible for the data protection file within the company.
Reporting data breaches
If an entity learns of a data leak that could harm the data or its owners or affect their rights, it must notify the competent authority within seventy-two hours of learning of the leak, and notify the affected data subjects without delay.
• Put a written breach response plan in place before an incident occurs.
• Decide who makes decisions, who reports, and who communicates with candidates.
• Document every incident and the results of the investigation.
Transferring data outside the Kingdom
The law and the transfer regulation restrict sending candidate data outside the Kingdom, and it is permitted only under specific controls.
• Check where candidate data is stored when you use cloud recruitment or testing platforms.
• Ask the provider about its servers and the transfer safeguards it adheres to.
• Do not send candidate files to entities in other countries without confirming that the legal requirements are met.
Contracts with service providers
• Specify in the contract the limits on data use, its security, and its destruction when the contract ends.
• Require the provider to report immediately any incident involving your data.
• Provide for the organization’s right to review the provider’s compliance periodically.
Candidate rights under the law
The right to be informed
The candidate has the right to know why their data is being collected, how it will be used, and with whom it will be shared.
The right of access and to obtain a copy
They may ask to access the data the organization holds about them and to obtain a copy of it, subject to exceptions set out in the law.
The right to correction and destruction
They may ask for inaccurate data to be corrected, or for it to be destroyed once it is no longer needed or they withdraw their consent.
The right to withdraw consent and to object
They may withdraw their consent to processing at any time, and the organization must stop the processing that relies on it unless there is another legal basis.
How should the organization handle requests?
• Set up a clear channel for candidate requests, such as a dedicated email address.
• Decide who receives the requests and who responds to them.
• Comply with the time limit set by the regulations for responding to requests; some sources mention thirty days, so check the official text to be sure.
• Document every request and the response to it.
Data protection in modern hiring tools
Online tests
• Tell the candidate what type of data the test collects and who will see their results.
• Do not use the results for anything other than hiring without consent.
• Store results in a secure system with limited permissions.
Camera monitoring in remote tests
• Record only what you actually need to verify the integrity of the test.
• Explain to the candidate in advance what will be recorded, why, and when it will be deleted.
• Keep the review of violations human, and do not take a decision against a candidate based on an automated alert alone.
Artificial intelligence and automated decisions
• Tell the candidate if an automated tool takes part in screening or assessing their application.
• Keep a human specialist responsible for reviewing results and making the decision.
• Test the tool periodically to make sure it does not discriminate against particular groups.
Recorded interviews
• Obtain explicit consent before recording the interview.
• Set a retention period for the recording and destroy it afterward.
• Limit access to recordings to the relevant assessors only.
Practical compliance steps for the hiring team
Step one: map candidate data
Know where you collect candidate data, who has access to it, where it is stored, and when it is destroyed.
Step two: update the privacy notice and consent forms
Make them clear, brief, and in Arabic, and make sure they match actual practice.
Step three: set a retention and destruction policy
Define retention periods for each type of data, and assign someone to carry them out and review them.
Step four: review service providers
Check the contracts, the storage location, and the security safeguards.
Step five: train the team
Train hiring team members on handling data, candidate requests, and incident reporting.
Step six: prepare a breach response plan
Write clear procedures, including the seventy-two-hour deadline, and test them at least once.
Step seven: review compliance periodically
Conduct an annual review of candidate data protection procedures, and update them when tools or regulations change.
Common mistakes in handling candidate data
• Keeping résumés with no time limit: this violates the principle of keeping data only as long as necessary.
• Sending files over insecure channels: such as personal messaging apps or shared email without controls.
• Asking for sensitive data without need: such as religion or health status unrelated to the job.
• Using data for another purpose: such as adding the candidate to marketing lists.
• No clear contract with the recruitment or testing provider: this leaves the organization responsible without safeguards.
• Ignoring candidate requests: this may lead to complaints before the competent authority.
• No breach plan: this delays reporting and multiplies the harm.
What are the penalties for violations?
The law provides for graduated penalties according to the seriousness of the violation, and according to specialized legal sources they include:
• A fine of up to five million riyals for general violations of the law, which may be doubled for repeat violations.
• Harsher penalties, which may include imprisonment and a fine, for anyone who discloses or publishes sensitive data with the intent to harm its owner or to gain a personal benefit.
• The possibility of publishing the ruling at the violator’s expense and confiscating funds obtained from the violation.
The details of these penalties vary according to the text of the law and its regulations, so you should refer to the official text or a legal advisor to confirm your specific case.
How does the Albayan Assessment platform help you?
When you use the Albayan Assessment platform for candidate tests and reports, you can discuss with the assessment team how candidate data is handled, from where it is stored to who can access it and how long it is kept, and link that to your organization’s privacy policy. If you are building a new assessment pathway for candidates, the team can help you take these requirements into account from the start.
Frequently asked questions
Do small companies need to comply with the Personal Data Protection Law?
Yes. The law applies to any entity that processes personal data and does not exempt small companies because of their size, although some obligations differ depending on the nature and scale of the processing.
Do I need the candidate’s consent to keep their résumé?
Consent is the main basis for processing under the law, with exceptions set out in the law and its regulations. It is therefore best to tell the candidate why their data is being collected and how long it will be kept, and to obtain their consent, especially if you want to keep their résumé for future opportunities.
How long should the files of unsuccessful candidates be kept?
The law does not set a single figure that applies to all cases; the principle is to keep data only for the period needed to achieve the purpose. Set a reasonable, justified period in your organization’s policy, and review any other legal requirements.
What should I do if candidate data is leaked?
Contain the incident immediately and assess the extent of the harm, notify the competent authority within seventy-two hours if the leak could harm the data or its owners, inform the affected candidates without delay, and document the actions taken.
Does a candidate have the right to ask for their data to be deleted?
Yes. A candidate may ask for their data to be destroyed when it is no longer needed or when they withdraw their consent, unless there is a legal basis that requires the organization to keep it.
Conclusion
Protecting candidate data is both a legal and an ethical obligation. It starts with collecting only the necessary data with clear consent, then storing it securely, keeping it only for the period required, respecting candidate rights, and being ready to report any leak. The better documented and more transparent the process, the more candidates trust your organization and the lower the risk of violations. If you want to build a candidate assessment pathway that takes these requirements into account, contact the Albayan Assessment team and book a consultation to help you get started, and consult your legal advisor to confirm full compliance.
