Privacy Policy

    Definitions
     For the purposes of this policy, the following terms and expressions shall have the meanings set forth next to each, unless the context requires otherwise:

Term

Definition

Law

The Personal Data Protection Law issued by Royal Decree No. (M/19), dated 9/2/1443H.

Regulation

The Executive Regulations of the Personal Data Protection Law.

Ministry

Ministry of Investment.

Office

The Data Management Office at the Ministry of Investment.

Personal Data

Any information, regardless of its source or form, that leads to identifying an individual specifically or makes it possible to identify them directly or indirectly. This includes: name, personal ID number, addresses, contact numbers, license and registration numbers, personal properties, bank account and credit card numbers, individual’s static or dynamic images, or any other personal data.

Data Processing

Any operation performed on personal data by any means, whether manual or automated. This includes: collection, recording, storing, indexing, organizing, structuring, modifying, updating, merging, retrieving, use, disclosure, transfer, publication, data sharing, interlinking, blocking, deletion, and destruction.

Controller

The entity that determines the purpose of personal data processing and how it is conducted, whether it processes data itself or through a processor.

Processor

The entity that processes personal data on behalf of and for the benefit of the controller.

Public Authority

Any ministry, department, public institution, general authority, or any independent body in the Kingdom, or any of its affiliates.

Competent Authority

Saudi Data and Artificial Intelligence Authority (SDAIA).

Personal Data Subject

The individual to whom the personal data pertains, or their representative, or the person with legal guardianship over them.

Personal Data Protection Officer

Responsible for monitoring the implementation of the provisions of the law and its regulations, overseeing the procedures within the controller, and receiving requests related to personal data as per the provisions of the law and its regulations.

Explicit Consent

Consent granted explicitly by the personal data subject in any form, indicating their acceptance of personal data processing in a way that cannot be otherwise interpreted, and must be provable.

Destruction

Any action taken on personal data making it impossible to access, retrieve, or identify the data subject specifically again.

Disclosure

Allowing any person, other than the controller or processor as appropriate, to obtain, use, or access personal data by any means and for any purpose.

Transfer

Moving personal data from one location to another for processing purposes.

Publication

Disseminating any personal data through a readable, audible, or visual publishing medium, or making it available.

Sensitive Data

Any personal information regarding an individual's ethnic origin, ethnicity, religious, intellectual, or political beliefs, as well as security and criminal data, biometric identifiers, genetic data, health data, and information indicating the individual is an orphan or has an unknown parent.

Genetic Data

Any personal information regarding an individual’s genetic or inherited characteristics, uniquely identifying their physiological or health traits, derived from the analysis of a biological sample, such as DNA analysis or any other sample that leads to the extraction of genetic information.

Health Data

Any personal information regarding an individual’s health condition, whether physical, mental, or psychological, or related to their private health services.

Credit Data

Any personal information regarding an individual’s credit application or their credit history, whether for personal or family purposes, from a credit provider. This includes any information related to their ability to acquire or fulfill credit or their credit history.

Personal Data Breach

Any incident leading to the disclosure, damage, or unauthorized access to personal data, whether intentional or unintentional, by any means, whether manual or automated.

Vital Interest

Any essential interest to preserve the life of the personal data subject.

Legitimate Interest

Any moral or material interest of the personal data subject directly related to the purpose of personal data processing, where processing is necessary to achieve that interest.

 

2- Purpose of the Policy:
 The Ministry of Investment upholds the importance of your personal data privacy as a fundamental principle. We respect and value the privacy of everyone visiting the Ministry’s online portal and affiliated platforms, affirming that personal data will be collected and used in compliance with the Personal Data Protection Law. In accordance with this law, the Ministry serves as the controller (i.e., the entity responsible for determining how your personal data is processed) and is accountable for its management.

3- About the Ministry:
 The Ministry is responsible for organizing, developing, and promoting local and foreign investment within the Kingdom and protecting investors' rights. It must take any necessary action to achieve its objectives, without infringing on the authorities and responsibilities of other entities, in accordance with its organizational framework issued by Council of Ministers Decision No. 594, dated 13 Shawwal 1442H.

  • Address: Imam Saud bin Abdulaziz bin Muhammad Road - Al Nakheel District
  • Phone: 8002449990
  • Website: WWW.MISA.GOV.SA

4- Personal Data to be Collected:
 The Ministry collects specific types of personal data for processing purposes outlined in Article 7 of this policy. The categories of data collected are as follows:

  • Data collected directly from the data subject: Collected through electronic forms.
    Account Data: Information required when creating an account or profile on the Ministry’s electronic services portal.

Registration Data: This includes Title, First Name, Last Name, ID/Residence Number, Company, Department, Email, Country, Country Code, Mobile Number, Username, Password, and Password Confirmation.

Licensing Data: Required for any investment activity licensing, including Shareholder Type, ID Type, ID Number (residence), Date of Birth, Gender, First Name, Last Name, Full Name in English, Date of Birth, ID Number (residence), Issue Date, Expiry Date, Current Nationality, Country, Distinguished Residency, Academic Degree, Share Percentage, Previous Nationality, Ministry Permit, City, P.O. Box, Postal Code, International Number, Mobile Number, Email, Country Code, Ministry of Foreign Affairs Authentication Request Number, Passport Copy, and Commercial Registration Number.

  • Identity Data: Title, First Name, Last Name, ID/Residence Number.
  • Contact Data: Email address and mobile phone number.
  • Establishment Data: Establishment name, department.
  • Geolocation Data: Country.

 

 

  • Data collected indirectly from the data subject:
    Cookie Data: Collected through website logs, cookies, or other technologies, including IP address, browser type and version, operating system, login details, browsing data, internet traffic monitoring, and other online identifiers.

5- Cookies
 Our website may store "First-Party Cookies" on your mobile device when you visit the Ministry's website or the Invest in Saudi platform. First-Party Cookies are those set directly by us and are used solely by us. Primarily, we use session cookies, which store information about the user only during the session and browsing. These cookies are deleted immediately once the user exits our website and closes their browser window. The purpose of using cookies is to facilitate your experience with our website and to provide and improve our services.

To ensure the privacy and protection of your personal data at all times, we provide control settings so you may choose to enable or disable cookies in your internet browser. Most internet browsers also allow you to choose whether to disable all cookies or third-party cookies only. By default, most internet browsers accept cookies, but this can be changed. You may choose to delete cookies on your device at any time; however, doing so may result in the loss of information that allows you quicker and more efficient access to our website, such as login settings and customization preferences.

6. Legal Basis for Collecting and Processing Your Personal Data:
 By using the Ministry of Investment platform and the Invest in Saudi platform, you expressly consent to the collection and processing of your data for the purposes specified in Article 7 of this policy. Your consent serves as the legal basis for the collection and processing of your personal data.

 

7. Purpose of Using and Processing Your Personal Data:
 Your personal data is used for specific and explicit purposes, in our capacity as the regulatory, oversight, and supervisory body for the investment sector in the Kingdom of Saudi Arabia, in accordance with the Ministry's regulation issued by the Council of Ministers Decision No. 594 dated 13 Shawwal 1442H. We also aim to streamline the investment licensing process, organize related procedures, provide services to investors, and foster a conducive investment environment. Consequently, all uses and processing of personal data by the Ministry are intended to fulfill the functions outlined in the referenced regulation, serve investors, and organize the investment sector in the Kingdom. These purposes include, without limitation, the following services—subject to the exceptions outlined in the Personal Data Protection Law and other relevant regulations:

  • Issuing investment licenses, organizing related procedures, providing Ministry services to investors, and determining service fees for investors.
  • Defining indicators to measure investment performance in the Kingdom and the measurement mechanism, in coordination with relevant entities, with the Ministry responsible for overseeing implementation and evaluating these indicators upon approval.
  • Attracting investments through organizing, participating in, and promoting conferences, seminars, internal and external exhibitions, and initiatives to encourage investment.
  • Establishing a unified investment database and its indicators within the Kingdom to serve as a primary reference for information related to the Ministry’s functions, coordinating with relevant entities to supply the Ministry with related information, data, and reports in line with the national data governance policies and regulations issued by the Saudi Data and Artificial Intelligence Authority.
  • Enhancing the sustainability of investment, promoting its role, addressing challenges and obstacles, and proposing potential incentives.
  • Coordinating with relevant government entities to enable the Ministry to perform its functions.
  • Representing the Kingdom or participating in its representation in regional and international organizations, bodies, forums, and conferences relevant to the Ministry's functions.
  • Conducting studies and research related to its functions and collaborating with research centers and specialized expert firms, both locally and internationally, in this regard.
  • Representing the government in negotiations with strategic investors, designing investment incentives, and submitting them for approval as needed.
  • Processing personal data related to violations and objections, including tracking and analyzing violations, receiving objections, resolving them, and handling related matters.
  • Sending, transferring, and receiving governmental correspondences within the Ministry and with other entities, as well as exchanging documents, letters, and other materials.
  • Receiving investor complaints, analyzing, and addressing them.
  • Sending periodic emails and SMS messages to process requests and deliver information and updates related to your request, in addition to general news, updates, and products related to the Ministry.
  • Receiving, processing, and sorting job applications submitted for vacant positions advertised on the Ministry’s website.

Additionally, technical data, usage data, and profile data are used for the following purposes:

  • The use of the Ministry’s website and your IP address helps diagnose server issues and assists in conducting usage statistics (such as visitor numbers, computer language, and browser type). Access to your IP address is restricted to the Ministry's technical team only.
  • Enhancing user experience by improving and developing the Ministry of Investment website to meet user needs and services.
  • Enhancing investor services by responding more effectively to customer service requests and support needs.
  • The Ministry may use “Google Analytics” reports to conduct website analyses using information obtained from IP addresses, showing details such as country, city, device, visited pages, and session time on each visited page. These reports are used internally for analysis and website development purposes only.
  • The Ministry may collect and process your personal data for purposes not specified in this policy if the collection and processing of personal data are required for public interest, security purposes, to enforce another law, or to fulfill judicial requirements.

 

8. Rights of the Personal Data Subject
 According to Article 4 of the Personal Data Protection Law, you are entitled to the following rights:

  • Right to be Informed: This includes being informed of the legal or practical basis for collecting your personal data, the purpose of its collection and processing, how it is processed, stored, and destroyed, and to whom it will be disclosed.
  • Right to Access and Request Your Personal Data: You have the right to view your personal data, as well as request a copy of the data we have processed and retained within the Ministry.
  • Right to Request Data Correction: You may correct, complete, or update your data if it is inaccurate, incorrect, or incomplete.
  • Right to Request Data Destruction: You may request the destruction of your personal data that we have processed when it is no longer needed, in accordance with the Personal Data Protection Law.
  • Right to Withdraw Consent for Processing Your Personal Data: You have the right to withdraw your consent for processing your personal data at any time, provided there are no legal grounds requiring otherwise.

To exercise any of your rights under the law, or if any changes or updates occur to your personal data, you may contact us using the contact information provided below.

As stated in paragraph (b) of clause 1 and clause 2 of Article 9 of the law, your right to access your personal data mentioned above in clause 2 may be restricted, preventing you from accessing your personal data.

9. Protection of Your Personal Data
 Your personal data will only be accessible to Ministry employees or authorized third-party employees, who are trusted processors handling data on behalf of the Ministry. Contractual agreements are in place with these parties to ensure the secure use of data in compliance with the Personal Data Protection Law, limiting the use of your personal data strictly to the specified purposes.

We ensure that we implement appropriate technical and organizational security measures to protect your personal data in compliance with the Personal Data Protection Law. Examples of these security measures include, but are not limited to:

  • Vulnerability Scanning and Penetration Testing: Detecting and addressing vulnerabilities.
  • Data Encryption: Encrypting data during transmission and storage.
  • Regular Updates and Patches: Applying periodic updates and patches.
  • Security and Hardening Reviews: Regularly reviewing and strengthening system security settings.
  • Applying Security Standards: Following best practices in security for website and application development.
  • Secure Infrastructure: Collecting data within a secure technical infrastructure, adhering to the Ministry’s approved cybersecurity policies and standards, which comply with regulations issued by the National Cybersecurity Authority.
  • Procedures for Data Loss Prevention: Establishing security measures based on the Ministry’s approved cybersecurity controls and policies, in accordance with standards from the National Cybersecurity Authority, to prevent accidental loss, unauthorized access, alteration, or disclosure of your personal data.
  • Data Sharing Management: The Ministry applies procedures for managing data sharing, ensuring that data will not be made publicly available and will not be shared with any other party without prior consent from the data subject, except in cases of compliance with applicable policies, systems, and laws.
  • Permissions and Data Access Management: The Ministry enforces access control measures, ensuring data access is restricted to authorized personnel providing Ministry of Investment services and government entities contributing to service development and facilitating beneficiary procedures.

10. Disclosure of Your Personal Data
 Without prejudice to paragraphs (3, 4, and 5) of Article 15 of the Personal Data Protection Law, you consent to the sharing of your personal data with relevant entities, whether public or private, in accordance with a legal basis authorizing the requesting entity to obtain it. All necessary organizational, administrative, and technical measures will be taken prior to data sharing as stipulated in Article 19 of the law.

11. Storage of Your Personal Data
 By using the Ministry’s platform and Invest in Saudi, you consent to the storage, processing, and use of your data by the Ministry. Your personal data will be stored securely within the Ministry or with authorized third parties within the Kingdom of Saudi Arabia. No data will be stored outside the Kingdom except in compliance with the regulations specified in the Executive Regulations on transferring personal data outside the Kingdom.

12. Data Retention and Destruction
 Your personal data will be retained for the specified duration during which the purpose for which it was collected remains valid. Once the purpose for your personal data has ended, or upon your request, it will be promptly deleted in a secure manner to prevent recovery, while considering other applicable legal, regulatory, or operational requirements in the Kingdom of Saudi Arabia, without prejudice to the exceptions provided in Article 18 of the Personal Data Protection Law.

13. Changes to the Privacy Policy
 Users should continuously review the privacy policy, which may be updated at any time. Updates will be published on the privacy policy page, indicating the latest revision. The Ministry reserves the right to modify the privacy policy as necessary, and any amendments to the terms and conditions shall become effective immediately upon approval without any obligation to notify.

  • This policy was created on 25 November 2021.
  • The latest policy update was on 9 October 2024.

14. Contact Us
 For inquiries regarding the Ministry of Investment’s privacy policy, complaints, or requests concerning the privacy and protection of your personal data, you may contact the Data Management Office team or our Personal Data Protection Officer via the following email: DMO@misa.gov.sa.

For further details on the processing of your personal data and how to exercise your rights, please contact the Ministry of Investment’s Personal Data Protection Officer using the contact information below:

  • Personal Data Protection Officer
    Address: Ministry of Investment, Riyadh City, Imam Saud bin Abdulaziz bin Muhammad Road - Al Nakheel District
    Phone Number: 0115064133
    Email: aalolaiwi@misa.gov.sa

If you are unsatisfied with our handling of your complaint, you may file a complaint with the competent authority, the Saudi Data and Artificial Intelligence Authority (SDAIA).

Address of Saudi Data and Artificial Intelligence Authority Contact 

Kingdom of Saudi Arabia, Riyadh

 

Website: SDAIA (sdaia.gov.sa)

National Data Governance Platform (dgp.sdaia.sa) 

 

P.O. Box 5927 Riyadh 11432, Kingdom of Saudi Arabia
 misa.gov.sa