The Saudi Data and Artificial Intelligence Authority (SDAIA) has revealed a set of requirements for the secondary use of data in Saudi Arabia, with the aim of controlling and governing its operations, and ensuring that it does not exceed its intended purpose. In addition, it sets controls and procedures that regulate the request to share data for secondary use purposes, in an effort to encourage government agencies to share data to support research, development and innovation, and to achieve the public interest by improving the efficiency of government agencies’ work and activities, and using data to support decision-making, in addition to supporting the implementation of national strategies and objectives by enabling agencies to obtain data for secondary use purposes.

According to this regulation (under study), before any data sharing process takes place, the applicant must commit to having a legitimate purpose for sharing the data, so that this purpose can be adapted under the scope of achieving the public interest or developing research, development and innovation, while verifying that it is not related to profit purposes, and that the content of the data requested is limited to the minimum necessary to achieve the purpose of the sharing request.

It is also required that the data sharing request be submitted to the source entity, as originally intended, or that proof of the source entity’s approval be provided if the request is submitted to an entity other than the source entity, or the authorized entity.

She said: If the data sharing request is submitted between government entities, the steps stipulated in the policy are completed. If the data sharing request is submitted between government entities, and the request is related to conducting analyses and issuing reports, and does not require obtaining the data in its raw form, then what is stated in the rules of governance of data analysis laboratories is applied. If the data sharing request is submitted from a private entity to a government entity, the applicant and the entity from which the data sharing is requested obtain a usage license from the entity from which the data sharing is requested, and the applicant must commit to using the data in accordance with what is stated in the usage license.

She added that if the applicant is an individual and a member of a research or academic institution, the request should be submitted through their affiliated institution or the entity sponsoring the research that requires data sharing. The applicant must also provide proof of written approval from their academic supervisor before submitting the request for secondary data sharing. Furthermore, the applicant must clearly state the content of the request when submitting it to avoid any incomplete or missing information that could lead to rejection, according to a form prepared by the office for this purpose.

The draft confirmed that the entity required to share data must include conditions related to intellectual property and trade secrets in the usage license, if required, and that the entity required to share data must evaluate the data sharing request in accordance with the requirements stipulated by law.

Controls and requirements

She added that the steps outlined in item (VI) of the policy are based on data sharing steps for secondary use within a procedural framework for government agencies, private entities, and individuals, including those involved in research, development, and innovation, as well as researchers and entrepreneurs. These steps enable compliance with all necessary controls and requirements according to these rules and other relevant regulatory documents, as follows:

If a data sharing request for the purposes stipulated in paragraph (1) of section (a) of these rules is submitted between two government entities, the request shall be submitted through the Data Marketplace platform, in accordance with the steps stipulated in section (VI) of the policy, including the timeframes thereof. If a data sharing request for the purposes stipulated in paragraph (1) of section (a) of these rules is submitted from a government entity to a private entity or from a private entity to a government entity, and the data is required through an automated means, the parties to the sharing process shall propose a data sharing method and obtain the Office's approval thereof. If a data sharing request for the purposes stipulated in paragraph (1) of section (a) of these rules is submitted from a government entity to a private entity or from a private entity to a government entity, and the data is required through a non-automated means, the parties to the data sharing process shall share the data through a secure and reliable means, in accordance with the regulations issued by the competent authorities.

The draft added that the entity required to share data should take into account the urgent nature of data sharing requests for the purposes of achieving the public interest, when evaluating the data sharing requests submitted to it, and give them priority in processing.

The assessment of the connection between obtaining the data required to be shared and the public interest is subject to the discretion of the requesting government entity, in accordance with the regulatory texts relating to its exercise of its powers and performance of its duties, and the entity required to share the data must evaluate the request in light of that.

Any party to a data-sharing process based on these rules may submit a request to the National Data Management Office for a statutory opinion on any dispute arising from the application of these rules.

These rules apply to requests for data sharing between government and private entities for the purpose of secondary data use.