Personal Data Protection Policy

This policy aims to meet the requirements of the National Data Management Office, enhance the protection of data for users of Najran University systems and their privacy, and how data is handled, stored, and disposed of through:

  • Protecting the privacy of personal data and the confidentiality of sensitive data and not sharing it with other parties without user consent within the system.
  • Ensuring individuals’ rights to deal with personal data held by Najran University.
  • Promoting transparency and establishing governance by distributing roles and responsibilities.
  • Supporting integrity and combating corruption.

This is based on the documents: Data Management, Governance, and Personal Data Protection Controls (Version 1.5 - January 2021), and the National Data Governance Policies (Version 2 dated 26/05/2021 AD) issued by the National Data Management Office.

Scope of Work

This policy applies to all entities of Najran University and its branches to ensure the protection of personal data processed partially or fully by them, as well as it applies to external parties that process individuals’ data residing in Saudi Arabia through the internet or any other means.

However, the following cases are excluded from the scope of this policy: collecting personal data without the knowledge of its owner, processing it for purposes other than those for which it was collected, disclosing it without consent, or transferring it outside the Kingdom, under the following conditions:

  • If the controlling party is a government entity, it may collect or process personal data if it is necessary to meet regulatory requirements according to the systems and regulations and policies approved in the Kingdom of Saudi Arabia, or to comply with judicial requirements, or to fulfill obligations arising from an agreement in which the Kingdom of Saudi Arabia is a party.
  • To protect public health and safety, or to ensure the vital interests of individuals.

Key Principles for Protecting Personal Data

Principle 1: Responsibility

Najran University is committed to defining its requirements and policies for personal data protection, documenting them, reviewing them annually, and approving them by the University President or his designee. It also works to publish them to all relevant parties to ensure their effective implementation.

Principle 2: Transparency

A notice will be prepared outlining the privacy policies and procedures regarding personal data at Najran University, clearly, specifically, and explicitly stating the purposes for which personal data is processed.

Principle 3: Choice and Consent

All possible options must be provided to the data subject, and their consent obtained, whether express or implied, regarding the collection, use, or disclosure of their data.

Principle 4: Data Minimization

The collection of personal data shall be limited to the minimum necessary to achieve the purposes stated in the privacy notice.

Principle 5: Limitation of Use, Retention and Disposal

Processing of personal data is restricted to the purposes stated in the privacy notice with which the data subject has agreed, whether explicitly or implicitly. Data will be retained as long as necessary to achieve the specified purposes or as required by applicable laws and regulations and policies in the Kingdom of Saudi Arabia, and disposed of securely through methods that prevent leakage, loss, theft, or unauthorized access.

Principle Six: Access to Data

It should be provided with means allowing the data subject to access their data for review, updating and correction.

Principle Seven: Limitation of Data Disclosure

The disclosure of personal data to third parties within Saudi Arabia or outside it is restricted to the purposes specified in the privacy notice that the data subject has agreed to, whether explicitly or implicitly.

Principle Eight: Data Security

Najran University provides full protection of personal data from leakage, damage, loss, misappropriation, misuse, or unauthorized access, according to the directives of the National Cyber Security Authority and relevant authorities.

Principle Nine: Data Quality

Personal data is preserved accurately and completely in relation directly to the purposes specified in the privacy notice.

Principle Ten: Monitoring and Compliance

Monitoring of compliance with Najran University's privacy policies and procedures, with addressing inquiries, complaints and disputes related to it.

Rights of the Data Subject

  • First: The right to be informed which includes informing them about the legal basis or actual need for collecting their personal data, the purpose thereof, and that their data will not subsequently be processed in a manner inconsistent with the purpose for which it was collected and for which they provided implicit or explicit consent.
  • Secondly: The right to withdraw his consent regarding the processing of his personal data – at any time – unless there are legitimate purposes requiring its reversal.
  • Thirdly: The right to access his personal data with Najran University; for review, requesting correction or updating it.

Najran University’s Obligations

  • Najran University is committed to drafting and implementing policies and procedures related to the protection of personal data, and the primary responsible party – or whoever delegates him – is responsible for approving and adopting them.
  • The University undertakes to establish a data governance unit affiliated with the Data Management Office and tasked with developing, documenting, and monitoring the implementation of the policies and procedures approved by the Supreme Administration of the entity, including the tasks and responsibilities of the unit and establishing appropriate standards to determine levels of sensitivity of personal data.
  • The University undertakes to assess risks and potential impacts of activities processing personal data and present the results of the assessment to the President of the University – or whoever delegates him to determine risk acceptance level and approve it.
  • The University undertakes to review and update contracts and service level agreements and operating agreements in accordance with the privacy policies approved by the Supreme Administration of the entity.
  • Drafting and documenting the necessary procedures for managing and processing breaches of privacy and defining tasks and responsibilities of the specialized work team, and the cases where notification to the regulatory body and the Office is carried out according to the administrative sequence based on measuring the severity of the impact.
  • The University is issuing awareness programs for university members to enhance the culture of privacy and raise awareness levels in accordance with the policies and procedures for privacy adopted by the Supreme Administration for the relevant entity.
  • The data subject will be notified – via an appropriate method and date of data collection – regarding the purpose, legal basis/actual need, means and methods used for collecting, processing, and sharing personal data, as well as security measures to ensure the protection of privacy in accordance with the systems, regulations, and policies in effect throughout the Kingdom.
  • The data subject will be informed about other sources that are being used if additional data is collected via a non-direct method (from other entities).
  • The data subject will be kept informed of the privacy notice and consent to the processing of his personal data based on the nature of the data and methods for collecting it.
  • It should be taken consent of the data subject on the processing of personal data after defining the type of consent (explicit or implicit) based on the nature of the data and methods for collecting it.
  • The purpose of collecting data should be consistent with the systems, regulations, and policies in effect throughout the Kingdom and directly related to the activity of the entity.
  • The content of the data should be limited to the minimum of the data necessary to achieve the purpose for which it was collected.
  • Data collection should be restricted to the aforementioned content (as explained in Rule 12) and should be done fairly (direct, clear, safe and free from deception or misleading methods).
  • The use of data should be limited to the purpose for which it was collected.
  • The University is preparing and documenting a privacy policy and procedures for data retention in accordance with the specified purposes, systems, and related legislation.
  • The University stores and processes personal data within the geographical boundaries of the Kingdom of Saudi Arabia to ensure the preservation of its digital sovereignty for this data, and it is not permitted to process it outside the Kingdom of Saudi Arabia unless the University obtains a written approval from the regulatory authority, after coordination by the authority with the Office.
  • That the University establishes and documents policies and procedures for the disposal of data through the safe destruction of data to prevent its loss or misuse or unauthorized access – including operational, risk-assessed, and backup data – in accordance with what is issued by the National Cybersecurity Authority.
  • That the University incorporates provisions of its personal data retention and disposal policy in contracts when assigning these tasks to other processing entities.
  • That the University identifies and provides the means by which data subjects can access their personal data for review and update.
  • That the University verifies the identity of individuals before granting them access to their personal data in accordance with the controls established by the National Cybersecurity Authority and relevant authorities.
  • The sharing of personal data with other entities is prohibited unless according to the purposes specified after obtaining consent from the data subject, in accordance with systems, regulations, and policies, providing other entities with privacy policies and including them in contracts and agreements.
  • That the University shall ensure that individuals with data possess it and obtain approval from them in cases of sharing data with other entities for use beyond specified purposes.
  • That the University shall take prior approval from the Office – following coordination with the regulatory authority – before sharing personal data with other parties outside the Kingdom.
  • That the University shall prepare and document and implement the necessary procedures to ensure the accuracy, completeness, currency, and relevance of personal data collected for its intended purpose.
  • That the administrative controls and technical measures adopted by the entity’s information security policies shall be utilized to ensure the protection of personal data, including but not limited to:
    • Granting access to data according to the tasks and responsibilities of employees in a manner that prevents overlap of jurisdictions and avoids fragmentation of responsibilities.
    • Implementing administrative procedures and technical measures that document the stages of data processing and provide the possibility of identifying the user responsible for each stage of these phases (usage logs).
    • Employees who undertake data processing operations shall sign an undertaking to maintain the data and not disclose it except in accordance with policies, procedures, regulations, and legislation.
    • Employees who undertake data processing operations shall be selected based on integrity, responsibility, and in accordance with the nature and sensitivity of the data and access policy adopted by the entity.
    • Utilize appropriate security measures – such as encryption and isolating the development and testing environments from production environments – to protect personal data and safeguard it in accordance with its nature, sensitivity, and the media used for its transmission and storage, in line with what is issued by the National Cyber Security Authority and relevant authorities.
  • Najran University shall be responsible for monitoring compliance with privacy policies and procedures periodically, which will be displayed to the Chief of the Entity – or whoever delegates this responsibility – as determined and documented corrective actions that will be taken in case of non-compliance and notification to the regulatory body and the Office according to the organizational sequence.

General Provisions

  • First: Regulatory authorities shall harmonize the provisions of this policy with their own regulatory documents and disseminate them to all entities affiliated with or related to them, as achieves integration and ensures achieving the intended goal of preparing this policy.
  • Second: Regulatory bodies will monitor compliance with this policy periodically.
  • Third: The University must comply with this policy and document its compliance according to the mechanisms and procedures defined by the regulatory authorities.
  • Fourth: The University shall immediately and without delay notify the regulatory bodies, not exceeding 72 hours upon occurrence or discovery of any incident of personal data leakage according to the mechanisms and procedures defined by the regulatory authorities.
  • Fifth: When contracting with processing entities, the University shall periodically verify the compliance of these entities with this policy according to the mechanisms and procedures defined by the regulatory authorities, including any subsequent contracts entered into by these entities.
  • Sixth: The Data Office performs the roles and responsibilities of regulatory agencies on the non-regulatory agency office.
  • Seventh: Regulatory bodies may establish additional rules to process specific types of personal data in accordance with the nature and sensitivity of this data after coordinating with the Office.
  • Eighth: The regulatory bodies, after coordinating with the Office – will prepare the mechanisms and procedures that regulate the complaint processing process according to a specified timeframe and in accordance with the University’s organizational sequence.
  • Ninth: The University Data Office establishes the necessary standards to help the University determine whether appointing a data protection officer is a mandatory or optional requirement.