Privacy Policy

Third version
October 2024
Privacy Policy
1. Definitions
For the purposes of this policy, the following terms and expressions shall have the
meanings set forth next to each, unless the context requires otherwise:

Term Definition

The Personal Data Protection Law issued by Royal Decree No. (M/19), dated
Law
9/2/1443H.

Regulation The Executive Regulations of the Personal Data Protection Law.

Ministry Ministry of Investment.

Office The Data Management Office at the Ministry of Investment.

Any information, regardless of its source or form, that leads to identifying an

individual specifically or makes it possible to identify them directly or
indirectly. This includes: name, personal ID number, addresses, contact
Personal Data
numbers, license and registration numbers, personal properties, bank account
and credit card numbers, individual’s static or dynamic images, or any other
personal data.

Any operation performed on personal data by any means, whether manual or

automated. This includes: collection, recording, storing, indexing, organizing,
Data
structuring, modifying, updating, merging, retrieving, use, disclosure,
Processing
transfer, publication, data sharing, interlinking, blocking, deletion, and
destruction.

The entity that determines the purpose of personal data processing and how it
Controller
is conducted, whether it processes data itself or through a processor.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

Term Definition

The entity that processes personal data on behalf of and for the benefit of the
Processor
controller.

Public Any ministry, department, public institution, general authority, or any

Authority independent body in the Kingdom, or any of its affiliates.

Competent
Saudi Data and Artificial Intelligence Authority (SDAIA).
Authority

Personal Data The individual to whom the personal data pertains, or their representative, or
Subject the person with legal guardianship over them.

Responsible for monitoring the implementation of the provisions of the law

Personal Data
and its regulations, overseeing the procedures within the controller, and
Protection
receiving requests related to personal data as per the provisions of the law and
Officer
its regulations.

Consent granted explicitly by the personal data subject in any form, indicating
Explicit
their acceptance of personal data processing in a way that cannot be otherwise
Consent
interpreted, and must be provable.

Any action taken on personal data making it impossible to access, retrieve, or

Destruction
identify the data subject specifically again.

Allowing any person, other than the controller or processor as appropriate, to

Disclosure
obtain, use, or access personal data by any means and for any purpose.

Transfer Moving personal data from one location to another for processing purposes.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

Term Definition

Disseminating any personal data through a readable, audible, or visual

Publication
publishing medium, or making it available.

Any personal information regarding an individual's ethnic origin, ethnicity,

religious, intellectual, or political beliefs, as well as security and criminal data,
Sensitive Data
biometric identifiers, genetic data, health data, and information indicating the
individual is an orphan or has an unknown parent.

Any personal information regarding an individual’s genetic or inherited

characteristics, uniquely identifying their physiological or health traits,
Genetic Data
derived from the analysis of a biological sample, such as DNA analysis or any
other sample that leads to the extraction of genetic information.

Any personal information regarding an individual’s health condition, whether

Health Data
physical, mental, or psychological, or related to their private health services.

Any personal information regarding an individual’s credit application or their

credit history, whether for personal or family purposes, from a credit provider.
Credit Data
This includes any information related to their ability to acquire or fulfill credit
or their credit history.

Any incident leading to the disclosure, damage, or unauthorized access to

Personal Data
personal data, whether intentional or unintentional, by any means, whether
Breach
manual or automated.

Vital Interest Any essential interest to preserve the life of the personal data subject.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

Term Definition

Any moral or material interest of the personal data subject directly related to
Legitimate
the purpose of personal data processing, where processing is necessary to
Interest
achieve that interest.

2- Purpose of the Policy:

The Ministry of Investment upholds the importance of your personal data privacy as a
fundamental principle. We respect and value the privacy of everyone visiting the Ministry’s
online portal and affiliated platforms, affirming that personal data will be collected and used in
compliance with the Personal Data Protection Law. In accordance with this law, the Ministry
serves as the controller (i.e., the entity responsible for determining how your personal data is
processed) and is accountable for its management.
3- About the Ministry:
The Ministry is responsible for organizing, developing, and promoting local and foreign
investment within the Kingdom and protecting investors' rights. It must take any necessary action
to achieve its objectives, without infringing on the authorities and responsibilities of other
entities, in accordance with its organizational framework issued by Council of Ministers Decision
No. 594, dated 13 Shawwal 1442H.
• Address: Imam Saud bin Abdulaziz bin Muhammad Road - Al Nakheel District
• Phone: 8002449990
• Website: WWW.MISA.GOV.SA
4- Personal Data to be Collected:
The Ministry collects specific types of personal data for processing purposes outlined in Article
7 of this policy. The categories of data collected are as follows:

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

 • Data collected directly from the data subject: Collected through electronic forms.
Account Data: Information required when creating an account or profile on the
Ministry’s electronic services portal.
Registration Data: This includes Title, First Name, Last Name, ID/Residence Number,
Company, Department, Email, Country, Country Code, Mobile Number, Username, Password,
and Password Confirmation.
Licensing Data: Required for any investment activity licensing, including Shareholder Type, ID
Type, ID Number (residence), Date of Birth, Gender, First Name, Last Name, Full Name in
English, Date of Birth, ID Number (residence), Issue Date, Expiry Date, Current Nationality,
Country, Distinguished Residency, Academic Degree, Share Percentage, Previous Nationality,
Ministry Permit, City, P.O. Box, Postal Code, International Number, Mobile Number, Email,
Country Code, Ministry of Foreign Affairs Authentication Request Number, Passport Copy, and
Commercial Registration Number.
➢ Identity Data: Title, First Name, Last Name, ID/Residence Number.
➢ Contact Data: Email address and mobile phone number.
➢ Establishment Data: Establishment name, department.
➢ Geolocation Data: Country.

• Data collected indirectly from the data subject:

Cookie Data: Collected through website logs, cookies, or other technologies, including
IP address, browser type and version, operating system, login details, browsing data,
internet traffic monitoring, and other online identifiers.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

5- Cookies
Our website may store "First-Party Cookies" on your mobile device when you visit the
Ministry's website or the Invest in Saudi platform. First-Party Cookies are those set directly by
us and are used solely by us. Primarily, we use session cookies, which store information about
the user only during the session and browsing. These cookies are deleted immediately once the
user exits our website and closes their browser window. The purpose of using cookies is to
facilitate your experience with our website and to provide and improve our services.
To ensure the privacy and protection of your personal data at all times, we provide control
settings so you may choose to enable or disable cookies in your internet browser. Most internet
browsers also allow you to choose whether to disable all cookies or third-party cookies only. By
default, most internet browsers accept cookies, but this can be changed. You may choose to
delete cookies on your device at any time; however, doing so may result in the loss of information
that allows you quicker and more efficient access to our website, such as login settings and
customization preferences.
6. Legal Basis for Collecting and Processing Your Personal Data:
By using the Ministry of Investment platform and the Invest in Saudi platform, you expressly
consent to the collection and processing of your data for the purposes specified in Article 7 of
this policy. Your consent serves as the legal basis for the collection and processing of your
personal data.

7. Purpose of Using and Processing Your Personal Data:

Your personal data is used for specific and explicit purposes, in our capacity as the regulatory,
oversight, and supervisory body for the investment sector in the Kingdom of Saudi Arabia, in
accordance with the Ministry's regulation issued by the Council of Ministers Decision No. 594

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

dated 13 Shawwal 1442H. We also aim to streamline the investment licensing process, organize
related procedures, provide services to investors, and foster a conducive investment environment.
Consequently, all uses and processing of personal data by the Ministry are intended to fulfill the
functions outlined in the referenced regulation, serve investors, and organize the investment
sector in the Kingdom. These purposes include, without limitation, the following services—
subject to the exceptions outlined in the Personal Data Protection Law and other relevant
regulations:
• Issuing investment licenses, organizing related procedures, providing Ministry services
to investors, and determining service fees for investors.
• Defining indicators to measure investment performance in the Kingdom and the
measurement mechanism, in coordination with relevant entities, with the Ministry
responsible for overseeing implementation and evaluating these indicators upon
approval.
• Attracting investments through organizing, participating in, and promoting conferences,
seminars, internal and external exhibitions, and initiatives to encourage investment.
• Establishing a unified investment database and its indicators within the Kingdom to serve
as a primary reference for information related to the Ministry’s functions, coordinating
with relevant entities to supply the Ministry with related information, data, and reports
in line with the national data governance policies and regulations issued by the Saudi
Data and Artificial Intelligence Authority.
• Enhancing the sustainability of investment, promoting its role, addressing challenges and
obstacles, and proposing potential incentives.
• Coordinating with relevant government entities to enable the Ministry to perform its
functions.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

 • Representing the Kingdom or participating in its representation in regional and
international organizations, bodies, forums, and conferences relevant to the Ministry's
functions.
• Conducting studies and research related to its functions and collaborating with research
centers and specialized expert firms, both locally and internationally, in this regard.
• Representing the government in negotiations with strategic investors, designing
investment incentives, and submitting them for approval as needed.
• Processing personal data related to violations and objections, including tracking and
analyzing violations, receiving objections, resolving them, and handling related matters.
• Sending, transferring, and receiving governmental correspondences within the Ministry
and with other entities, as well as exchanging documents, letters, and other materials.
• Receiving investor complaints, analyzing, and addressing them.
• Sending periodic emails and SMS messages to process requests and deliver information
and updates related to your request, in addition to general news, updates, and products
related to the Ministry.
• Receiving, processing, and sorting job applications submitted for vacant positions
advertised on the Ministry’s website.
Additionally, technical data, usage data, and profile data are used for the following purposes:
• The use of the Ministry’s website and your IP address helps diagnose server issues and
assists in conducting usage statistics (such as visitor numbers, computer language, and
browser type). Access to your IP address is restricted to the Ministry's technical team
only.
• Enhancing user experience by improving and developing the Ministry of Investment
website to meet user needs and services.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

 • Enhancing investor services by responding more effectively to customer service requests
and support needs.
• The Ministry may use “Google Analytics” reports to conduct website analyses using
information obtained from IP addresses, showing details such as country, city, device,
visited pages, and session time on each visited page. These reports are used internally
for analysis and website development purposes only.
• The Ministry may collect and process your personal data for purposes not specified in
this policy if the collection and processing of personal data are required for public
interest, security purposes, to enforce another law, or to fulfill judicial requirements.

8. Rights of the Personal Data Subject

According to Article 4 of the Personal Data Protection Law, you are entitled to the following
rights:
• Right to be Informed: This includes being informed of the legal or practical basis for
collecting your personal data, the purpose of its collection and processing, how it is
processed, stored, and destroyed, and to whom it will be disclosed.
• Right to Access and Request Your Personal Data: You have the right to view your
personal data, as well as request a copy of the data we have processed and retained within
the Ministry.
• Right to Request Data Correction: You may correct, complete, or update your data if
it is inaccurate, incorrect, or incomplete.
• Right to Request Data Destruction: You may request the destruction of your personal
data that we have processed when it is no longer needed, in accordance with the Personal
Data Protection Law.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

 • Right to Withdraw Consent for Processing Your Personal Data: You have the right
to withdraw your consent for processing your personal data at any time, provided there
are no legal grounds requiring otherwise.
To exercise any of your rights under the law, or if any changes or updates occur to your personal
data, you may contact us using the contact information provided below.
As stated in paragraph (b) of clause 1 and clause 2 of Article 9 of the law, your right to access
your personal data mentioned above in clause 2 may be restricted, preventing you from accessing
your personal data.
9. Protection of Your Personal Data
Your personal data will only be accessible to Ministry employees or authorized third-party
employees, who are trusted processors handling data on behalf of the Ministry. Contractual
agreements are in place with these parties to ensure the secure use of data in compliance with the
Personal Data Protection Law, limiting the use of your personal data strictly to the specified
purposes.
We ensure that we implement appropriate technical and organizational security measures to
protect your personal data in compliance with the Personal Data Protection Law. Examples of
these security measures include, but are not limited to:
• Vulnerability Scanning and Penetration Testing: Detecting and addressing
vulnerabilities.
• Data Encryption: Encrypting data during transmission and storage.
• Regular Updates and Patches: Applying periodic updates and patches.
• Security and Hardening Reviews: Regularly reviewing and strengthening system
security settings.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

 • Applying Security Standards: Following best practices in security for website and
application development.
• Secure Infrastructure: Collecting data within a secure technical infrastructure,
adhering to the Ministry’s approved cybersecurity policies and standards, which comply
with regulations issued by the National Cybersecurity Authority.
• Procedures for Data Loss Prevention: Establishing security measures based on the
Ministry’s approved cybersecurity controls and policies, in accordance with standards
from the National Cybersecurity Authority, to prevent accidental loss, unauthorized
access, alteration, or disclosure of your personal data.
• Data Sharing Management: The Ministry applies procedures for managing data
sharing, ensuring that data will not be made publicly available and will not be shared
with any other party without prior consent from the data subject, except in cases of
compliance with applicable policies, systems, and laws.
• Permissions and Data Access Management: The Ministry enforces access control
measures, ensuring data access is restricted to authorized personnel providing Ministry
of Investment services and government entities contributing to service development and
facilitating beneficiary procedures.
10. Disclosure of Your Personal Data
Without prejudice to paragraphs (3, 4, and 5) of Article 15 of the Personal Data Protection Law,
you consent to the sharing of your personal data with relevant entities, whether public or private,
in accordance with a legal basis authorizing the requesting entity to obtain it. All necessary
organizational, administrative, and technical measures will be taken prior to data sharing as
stipulated in Article 19 of the law.

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

11. Storage of Your Personal Data
By using the Ministry’s platform and Invest in Saudi, you consent to the storage, processing, and
use of your data by the Ministry. Your personal data will be stored securely within the Ministry
or with authorized third parties within the Kingdom of Saudi Arabia. No data will be stored
outside the Kingdom except in compliance with the regulations specified in the Executive
Regulations on transferring personal data outside the Kingdom.
12. Data Retention and Destruction
Your personal data will be retained for the specified duration during which the purpose for which
it was collected remains valid. Once the purpose for your personal data has ended, or upon your
request, it will be promptly deleted in a secure manner to prevent recovery, while considering
other applicable legal, regulatory, or operational requirements in the Kingdom of Saudi Arabia,
without prejudice to the exceptions provided in Article 18 of the Personal Data Protection Law.
13. Changes to the Privacy Policy
Users should continuously review the privacy policy, which may be updated at any time. Updates
will be published on the privacy policy page, indicating the latest revision. The Ministry reserves
the right to modify the privacy policy as necessary, and any amendments to the terms and
conditions shall become effective immediately upon approval without any obligation to notify.
• This policy was created on 25 November 2021.
• The latest policy update was on 9 October 2024.
14. Contact Us
For inquiries regarding the Ministry of Investment’s privacy policy, complaints, or requests
concerning the privacy and protection of your personal data, you may contact the Data
Management Office team or our Personal Data Protection Officer via the following email:
[email protected].

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬

For further details on the processing of your personal data and how to exercise your rights, please
contact the Ministry of Investment’s Personal Data Protection Officer using the contact
information below:
• Personal Data Protection Officer
Address: Ministry of Investment, Riyadh City, Imam Saud bin Abdulaziz bin
Muhammad Road - Al Nakheel District
Phone Number: 0115064133
Email: [email protected]
If you are unsatisfied with our handling of your complaint, you may file a complaint with the
competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA).
Address of Saudi Data and Artificial Intelligence Authority Contact
Kingdom of Saudi Arabia, Riyadh

Website: SDAIA (sdaia.gov.sa)

National Data Governance Platform (dgp.sdaia.sa)

P.O. Box 5927 Riyadh 11432, Kingdom of Saudi Arabia

misa.gov.sa

misa.gov.sa ‫ اململكة العربية السعودية‬،11432 ‫ الرياض‬5927 ‫ ب‬.‫ص‬