Saudi Arabia: passenger data record

Personal Data Protection Law

SDAIA's National Data Governance Platform says the Personal Data Protection Law was issued on 9 Safar 1443 AH, corresponding to 16 September 2021 ¹. It calls the law the basic system that protects individuals' personal data and sets obligations for controllers and processors ¹. The General Authority for Statistics (GASTAT) cites the same issue date ².

GASTAT lists five rights it handles under Article 4 of the law: to be informed of the legal basis and purpose of collection, to access personal data, to get a copy, to correct data, and to request destruction ². It directs requests to its data protection officer ².

SDAIA and the National Data Governance Platform

The platform carries SDAIA's copyright and the National Data Management Office logo ¹. It offers registration in the National Register for Personal Data Protection for government, private, non-profit and foreign entities ¹. It offers a personal data breach notification service and a complaint route for individuals ¹. The platform page checked for this record does not describe notification deadlines ¹.

Passport authority and API

Saudi Arabia's passport directorate is known as Jawazat ⁴. In a summary of the ICAO Middle East Regional Seminar on API and PNR Data, held in Cairo from 24 to 26 June 2024, ICAO recorded that Saudi Arabia presented its work against terrorist travel and cross-border organized crime ³. Its Passenger Information Unit is the National Travelers Security Center, which processes API ³. A General Authority of Civil Aviation (GACA) facilitation specialist was among the Saudi participants ³. The summary does not state PNR status, retention periods or a supplier ³.

In August 2026 GACA ordered all airlines at Saudi airports to check that passengers hold the documents needed to enter, leave or transit, as reported by Khitam Al Amir for Gulf News ⁸. The report does not mention API or PNR ⁸.

E-visa data

The Visit Saudi e-visa portal tells applicants to fill in an application and pay the visa fee ⁶. Its privacy policy names the Ministry of Tourism as controller ⁷. Data listed includes passport details, a personal photograph, name, national identification number, date of birth, contact details and travel plans ⁷. The policy says data may be shared with government authorities, semi-government and private entities and service providers ⁷. It says data is stored in databases inside and outside Saudi Arabia and gives no fixed retention period ⁷. The policy names the Ministry of Foreign Affairs as the authority for changes to an electronic visa ⁷.

Biometric collection

The Ministry of Foreign Affairs publishes the Saudi Visa Bio app for visa biometric self-enrolment ⁵. It captures a facial image, fingerprints and a passport photo, and is listed for the Umrah visa ⁵. The ministry states that collected data is used only to verify identity and is deleted from the app after enrolment (provider page) ⁵.

Jawazat director Maj. Gen. Sulaiman bin Abdul Aziz Al-Yahya said the directorate was working on a facial-recognition system to identify newcomers and illegal stayers, as reported by Mohammed Al-Kinani for Arab News on 8 May 2018 ⁴. The same report said nearly all of an estimated 12.2 million foreigners in Saudi Arabia had been fingerprinted, citing GASTAT, and that eye-scan technology was in use ⁴.

Chronology