Information Access Policy

Privacy and Data Protection

The Social Development Bank recognizes the importance of your privacy and personal data. Therefore, we are committed to keeping all sensitive information and data for all users safe, secure, and confidential.

The Social Development Bank’s Privacy Policy and e-portal procedures are governed by the Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443 AH), the Key Principles for the Protection of Personal Information, and the Key Principles and General Rules for Data Exchange issued by the Saudi Data and Artificial Intelligence Authority and the National Data Management Office.

The Personal Data Protection Law and its Implementing Regulations establish the legal framework for protecting your rights regarding the processing of personal data by all entities within the Kingdom, as well as all entities outside the Kingdom that process personal data relating to individuals residing in the Kingdom using any means, including the processing of personal data online.

The core principles of our Data Protection Policy include:

The accountability of the entity’s head (or their representative) for the privacy policies and procedures of the data controller.

Transparency through a privacy notice that indicates the purposes for which personal data is collected. The choice and consent obtained through implied or express approval regarding the collection, use, and disclosure of personal data prior to its collection.

Limiting data collection to the minimum amount necessary to achieve the intended purposes.

Use, retention, and destruction strictly for the intended purpose, retaining data for as long as necessary to achieve the intended purposes or as required by law and regulations, and destroying it securely, preventing leakage, loss, theft, misuse, or unauthorized access.

Access to data through which any data subject can review, update, and correct their personal data.

Restrictions on data disclosure approved by the data subject that limit third parties to the purposes set out in the Privacy Notice.

Data security through the protection of personal data from leakage, damage, loss, theft, misuse, alteration, or unauthorized access, in accordance with controls issued by the National Cybersecurity Authority and other relevant authorities.

Data quality after verifying its accuracy, completeness, and timeliness. Monitoring and ensuring compliance with the data controller's privacy policies and procedures, and addressing any privacy-related inquiries, complaints, and disputes.

The National Standards for Data Management and Personal Data Protection cover 15 areas of data management and personal data protection. These standards apply to all government data, regardless of format or type, including paper records, emails, data stored electronically, audio recordings, videos, maps, images, scripts, handwritten documents, and other recorded data.

The application of the Personal Data Protection Law and its Implementing Regulations does not affect the powers and responsibilities of the National Cybersecurity Authority as the competent cybersecurity authority in the Kingdom.

Privacy and Data Protection Agreement

As a user of the electronic portal and its application, you accept the privacy and data protection policies and regulations of the Kingdom of Saudi Arabia that govern the portal and its application. This agreement becomes effective immediately upon your first use or access of the portal.

If you do not agree to this policy, you must not use any of the Social Development Bank's electronic portal services.

User Data Collection

The purpose of collecting personal data is directly related to the purposes of the online portal and does not conflict with any specific provision. The methods and means of collecting personal information are appropriate to the owner's circumstances, straightforward, transparent, secure, and free from deception, misleading information, or extortion. If it becomes apparent that the collected personal data is no longer necessary to achieve the purpose for which it was collected, the Social Development Bank's online portal will cease collecting it and immediately destroy the previously collected data. Read more

The Social Development Bank's online portal will ensure that the following criteria are met before collecting your personal data:

The justification for collecting your personal data.

The purpose of collecting your personal data, whether all or part of it, mandatory or optional, with further information about data processing that does not conflict with the purpose of its collection or is otherwise required by law.

The identity and reference address of the data collector, where applicable, unless for security purposes.

The entity or entities to which the personal data will be disclosed, a description of them, and whether the personal data will be transferred, disclosed, or processed outside the Kingdom.

The potential consequences and risks of non-compliance with the personal data collection procedure. Your privacy rights and data protection as stipulated by law.

Other elements as defined by regulations, depending on the nature of the entity's activities.

If personal data is collected from non-owners, the following conditions will apply:

If the data owner consents to this, in accordance with the provisions of the law.

If the personal data is publicly available or collected from a publicly available source.

If the entity is a public entity, and the collection of personal data is not directly owned or processed for a purpose other than that for which it was collected, such as for security purposes, to implement another system, or to satisfy judicial requirements, as defined by the regulations.

If compliance with this prohibition would harm the data owner or affect their vital interests, as defined by the regulations.

If the collection or processing of personal data is necessary to protect the health, safety, or well-being of the individual.