​The Saudi Central Bank (SAMA) lays emphasis on the protection of personal data, the data related to SAMA Services users, beneficiaries and customers. With a view to preserving the privacy and providing the best services, this Policy was developed to help the data subject to understand the nature of personal data processed by SAMA. The Privacy Policy also aims to demonstrate the purpose of collecting personal data, methods of collection, retention, processing, destruction, and the rights of the personal data subject as well as how to exercise these rights.

The use of SAMA website and other communication channels, in addition to the submission of personal data and information to SAMA, is considered as full consent to SAMA Privacy Policy.

Purpose of Collecting Personal Data:

1. Enable SAMA to carry out its mandate and responsibilities under the relevant laws and instructions, in maintaining the monetary and financial stability, and supporting the economic growth.

2. Understand user needs and strive to develop them. This includes, for example, addressing inquiries, requests, complaints and claims related to the financial sector, which falls under SAMA's supervision.

3. Conduct technical improvements and updates to SAMA's electronic services and monitor usage to deal with any security threats.

Scope and Content of the Personal Data Collected:

SAMA collects the minimum amount of personal data to perform the functions and operations. The data collected is based on its use.  This includes without limitation:

1. Personal data such as name, National identity number, date of birth, phone number, gender, place of residence, and other data of a personal nature.

2. Contact information and updates related to its usage.

3. User location data.

4. Other information provided by the user, such as: filling out complaint forms or the other necessary information for processing.

5. Data collected through web cookies.

Personal Data Collection:

1. Collecting personal data directly:

   Through SAMA's website and portals, approved mobile applications, phone calls, or through visiting SAMA's headquarters and official channels.

2. Collecting personal data indirectly:

   Through authorities or financial institutions under SAMA's supervision in cases of processing requests related to personal data subject.

Personal Data Retention:

Personal data are securely stored at SAMA's headquarters or on certified servers, following relevant policies and best practices standards and security rules.

Personal Data Processing:

1. SAMA uses personal data to perform the functions and responsibilities of the Saudi Central Bank, as per the relevant policies, rules and procedures in line with the relevant laws, regulations and official circulars.

2. Personal data are processed by SAMA's authorized individuals, as per the approved policies.

3. SAMA will not share personal data with any third party without the agreement of the data subject. However, SAMA reserves the right when necessary, at any time, to disclose, any information to the official authorities in case of a public interest or security purposes, to comply with the law, meet juridical requirements, comply with laws and regulations, process complaints or requests, protect public health or safety, and preserve an individual's life, as provided in the relevant regulations, rules and procedures.

Personal Data Destruction:

Personal data are destroyed once they are consumed for its purpose. Data will not be kept unless there is a legal justification for its retention for a specific period. When personal data are closely related to a juridical case, its retention is required during the period of the instructions. Personal data are destroyed after the legally specified period, the completion of the juridical instructions related to the case, or the end of the purpose for collecting the personal data - whichever is longer. When destroying the data, the adopted security regulations, policies and standards are followed.

Rights of Personal Data subject:

The personal data subject has the following rights in a way that does not conflict with the current rules and regulations:

1. The right to be informed, including being informed of the legal justification and the purpose for collecting his personal data.

2. The right to access and review his personal data and obtain a copy in a clear and readable format in conformity with the content of the records, free of charge, in accordance with the relevant laws and instructions in a way that does not conflict with the restrictions and exceptions stated therein, taking into account any periods that SAMA may impose for exercising or restricting this right.

3. The right to request correcting, completing or updating his personal data.

4. The right to request destroying his personal data that is no longer needed, without prejudice to the relevant laws and instructions.

Exercise of Personal Data Subject's Rights:

The personal data subject can exercise its rights or inquire about the privacy policy through the following service link: Exercise of the personal data subject's rights​.

Links to Other Websites:

SAMA's website and its affiliate platforms may include links to third party websites, for which SAMA is not responsible in any way, directly or indirectly, for any content found on those websites.

Privacy Policy Update:

• SAMA reserves the right to make amendments to this Policy at any time. These amendments are effective upon publication on SAMA's website. Continued use of the website and communication with SAMA after these amendments constitutes acceptance of these amendments. Therefore, we recommend reviewing the Privacy Policy periodically to stay informed of the latest version of the Policy. The last update to this Policy was on 07/11/2024.

• Arabic is the official language for this Policy, and its terms and conditions. In case of any disagreement in interpreting any text in any other language, the Arabic text shall prevail.

• This Policy is subject to the laws, regulations and policies applicable in the Kingdom of Saudi Arabia, and the Saudi courts shall have exclusive jurisdiction to consider and resolve any disputes or disagreements.