Introduction: The Common Misconception
Have you ever caught yourself—or heard someone—say, “But it’s public information, so it can’t be personal data”? You’re not alone.
In Arabic, mixing up شخصي (personal) and خاص (private) is so common that many assume personal data must be secret. Under the PDPL, however, any information that identifies you—whether hidden on a secure server or openly shown on your LinkedIn profile—is personal data.
Let’s dive into why this confusion happens, what the law really says, and how you can think about personal data more clearly.
Where the Mix-Up Really Begins: Why “Personal” Feels “Private”
“شخصي” (Personal) vs. “خاص” (Private) in Everyday Life
One word, two shades: When you say or hear “personal information” (معلومة شخصية), your mind pictures something exclusively yours—your basic identifying information, hobbies, or favorite café. But if you say “private information” (معلومة خاصة), you picture a locked drawer, a safe, or a closed-door conversation—bank balances, medical history, or family matters.
Everyday Illustrations
Example 1: Someone asks, “When’s your birthday?” and you instinctively think, “That’s personal!” (هذا شيء شخصي). This is because “personal” feels like “exclusively mine” or even “private.”
Example 2: Sharing someone’s mobile number without permission often triggers, “Why did you give them my number? That’s personal!” (لماذا أعطيتهم رقمي؟ هذا شيء شخصي)—again showing how “personal” is seen as confidential or private.
In casual conversation, both words often just mean “something about me I don’t share with everyone.” This overlap leads many to assume that unless data is labeled “private” or خاص, it can’t be “personal”—so public information is thought to slip outside the PDPL’s protection, even though the law says:
Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual.
Cultural Habits
In workshops and slide decks, trainers often say “البيانات الشخصية الخاصة” (“personal private data”) without pausing over that extra خاص. Learners hear “private” and think this means “must be hidden”—so anything public feels exempt.
Real-World Slip-Up
In one client meeting, a manager picked up a company brochure listing all employee names and titles and said: “No need to worry about masking these names—they’re public, right? That can’t be personal data.”
But under the PDPL, that brochure is full of personal data: Names + titles directly identify people. Publicly sharing it doesn’t erase your legal obligations—you still need a lawful basis, must keep it accurate, and must respond if someone asks, “What personal data do you hold on me?”
Thinking “public” means “not protected” perfectly shows how mixing up شخصي and خاص leads to misunderstanding. The reality: All identifying data is personal data, no matter where you find it.
Translation Quirks
Official vs. Unofficial: The PDPL’s English version simply says “personal data”—there is no mention of “private.” Yet many Arabic summaries add خاص or سرية to sound more complete.
The Unintended Effect: Adding “private” makes you think the law only cares about secret or hidden data, burying the real point: The PDPL protects all data that identifies you. Full stop.
What the PDPL Actually Says
Article 1 defines personal data as:
Any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including:
- Name
- Personal identification number
- Addresses
- Contact numbers
- License numbers
- Records
- Personal assets
- Bank and credit card numbers
- Photos and videos of an individual
- Any other data of a personal nature
In summary: If it points to an identifiable person, it’s personal data.
Why Public Personal Data Matters
Even public facts carry risks:
- Profiling
- Unwanted marketing
- Reputational damage
- Harassment
Recognizing that public information about a person is personal data under the PDPL helps you build trust, reduce legal risk, and strengthen data governance.
Sensitive vs. Confidential: Let’s Also Untangle Them
Sensitive Data (البيانات الحساسة)
- Racial or ethnic origin
- Religious, intellectual, or political beliefs
- Data relating to security, criminal convictions, and offenses
- Biometric or genetic data for the purpose of identifying the person
- Health data
- Data that indicates that one or both of the individual’s parents are unknown
Usually needs: Explicit consent + top-tier security. Even DSARs require extra ID checks.
Confidential Data (معلومات سرية)
Everyday Meaning: In day-to-day work, “confidential” simply means anything we agree to keep under wraps—project roadmaps, draft marketing plans, internal financial forecasts. These items may not contain any personal data at all (for example, the formula for Pepsi or the secret recipe used by KFC).
Why Confidentiality Isn’t a PDPL Category: The PDPL does not define “confidential data.” Instead, confidentiality in Saudi Arabia flows from:
- Contracts (NDAs, employment or service agreements) that parties sign, explicitly promising not to disclose certain information.
- Statutory Requirements under specific sector laws (for example, financial regulations or healthcare statutes) which impose confidentiality duties.
- Professional and Ethical Codes for regulated professions (lawyers, doctors, accountants) that bind individuals to keep client information secret.
Why It Matters
- Sensitive Data triggers legal obligations.
- Confidential Data relies on contractual or policy-based safeguards (NDAs, internal classification).
- Label Them Clearly so your teams know which rules to follow.
Summary
Drop the “Secret” Trap: شخصي ≠ خاص. Let go of the idea that “personal” means “secret.” After all, “Mohammed bin Salman Al Saud is the Prime Minister of KSA” identifies a unique person and is personal data but is definitely not a secret.
Focus on Identification: Personal data under the PDPL is about what points to you, not whether it’s hidden. Identifiability is the key.
Public Facts Count: If it identifies you, it’s personal data—online or offline.
Know Your Categories:
- “Sensitive” needs extra legal care.
- “Confidential” lives in the contract world.
