1.1 About the Policy

King Abdulaziz University affirms its unwavering commitment to protecting the privacy of the personal data of users of its electronic portal, digital platforms, applications, and electronic services. The University undertakes all necessary organizational, technical, and administrative measures to ensure that personal data is collected, processed, stored, shared, and disposed of securely and responsibly, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia, its Implementing Regulations, the relevant regulatory controls and instructions, and internationally recognized best practices and standards.

In line with its institutional responsibility, the University is committed to promoting the principles of governance, transparency, and compliance, while continuously developing controls and procedures related to personal data protection. This includes risk management, access control, cybersecurity enhancement, awareness programs, compliance monitoring, and ensuring the lawful and fair use of personal data across all academic, research, administrative, and service-related activities.

This Policy has been developed to clarify the general framework governing how the University handles personal data, to explain the rights of personal data subjects, and to enhance the confidence and transparency of beneficiaries when using the University's websites, digital platforms, applications, or any of its electronic services.

Scope of Application

This Policy applies to all personal data processed through the University's websites, digital platforms, applications, systems, and electronic services, or those operated on its behalf. This includes, but is not limited to:

  • The University's main website and the websites of its sectors, colleges, deanships, departments, and centers.
  • Electronic portals and academic, administrative, research, and service systems.
  • The University's smart device applications.
  • Digital platforms dedicated to communication, registration, learning, self-services, technical support, and beneficiary management.
  • Official websites and web pages affiliated with the University's entities.
  • Any future digital services launched by the University or developed in cooperation with authorized entities.

1.2 What Data We Collect and How We Collect It

First: Data You Provide to Us Directly

Examples include your full name, national ID number, Iqama (residency) number, university ID or employee number where applicable, email address, phone number, postal address, academic information related to study and enrollment, employment information, job application data, and trainee information relating to training programs.

Second: Data Collected Automatically When You Use Our Digital Services

Examples include your Internet Protocol (IP) address, device type, browser type, operating system, pages you visit, browsing duration, electronic transaction logs, cookies, and similar tracking technologies.

Third: Data Received from Other Sources

We may obtain personal data from trusted governmental, educational, regulatory, or contractual entities in accordance with applicable laws and approved agreements. In such cases, we will notify you within a period not exceeding thirty (30) days from the date we receive the data, in accordance with the Implementing Regulations, unless a legal exception applies.

Fourth: Mandatory, Optional, and Sensitive Data

For each data collection form, we clearly indicate which information is mandatory for providing the requested service, which information is optional, and the consequences of not providing the mandatory information. We do not collect sensitive personal data—such as health information processed through our medical services—except where necessary, with your explicit consent or another lawful basis, and subject to enhanced security and protection measures.

1.3 Purposes of Processing Personal Data

  • To provide academic, administrative, research, and support services.
  • To process user requests and complete electronic transactions and services.
  • To improve our websites, digital platforms, and electronic services, and enhance the user experience.
  • To conduct studies, analyses, and statistical reporting to support development and informed decision-making.
  • To communicate with users regarding news, events, services, and important notifications.
  • To verify identity and manage access to systems and digital services.
  • To manage human resources, financial, and operational activities.
  • To complete academic admission procedures and support students throughout their academic journey.
  • To send awareness messages and notifications related to the services provided.
  • To comply with applicable legal, regulatory, and judicial obligations.
  • To protect systems, manage risks, strengthen cybersecurity, and ensure business continuity.
  • To conduct scientific research in accordance with approved ethical and regulatory frameworks.
We will not process your personal data for a new purpose that differs from the purpose for which it was originally collected except in accordance with applicable legal requirements and after notifying you accordingly.

1.4 Consent

  • Where consent constitutes the lawful basis for processing, we will obtain your consent in a clear and transparent manner for each specific purpose. We will not make your consent a condition for obtaining a service or benefit unless the service is directly related to the processing for which consent is required.
  • We will obtain your explicit consent before processing sensitive personal data or credit information, or before making decisions based solely on automated processing.
  • You have the right to withdraw your consent at any time through procedures that are no less simple or accessible than those used to provide it, using the channels specified in this Policy. We will cease any processing based on your consent without undue delay.
  • The withdrawal of your consent does not affect the lawfulness of any processing carried out prior to such withdrawal, nor does it affect any processing carried out on the basis of another lawful ground.
  • When processing the personal data of individuals lacking legal capacity, we will obtain the consent of their legal guardian after verifying the validity of the guardianship, in a manner that serves the best interests of the personal data subject.

1.5 Sharing and Disclosure of Personal Data

The University shares or discloses personal data only to the extent necessary and in accordance with applicable legal and regulatory requirements, in the following circumstances:

  • With authorized entities within the University.
  • With competent government authorities to comply with applicable legal or regulatory requirements.
  • With contracted service providers or data processors under binding contractual agreements.
  • To protect legal rights or in response to judicial orders.
  • In other circumstances permitted by applicable law or based on valid consent where required.

1.6 Cross-Border Transfer of Personal Data

Personal data shall not be transferred outside the Kingdom of Saudi Arabia except as permitted by the applicable laws, regulations, and relevant regulatory controls, and only after all legal requirements have been fulfilled and the necessary safeguards have been implemented to ensure the protection of personal data.

1.7 Data Retention and Disposal

  • We retain your personal data for as long as necessary to fulfill the purposes for which it was collected or for the retention periods required by applicable laws and regulations.
  • Retention periods are determined based on several criteria, including the nature and duration of your relationship with the University, applicable legal and regulatory requirements for the retention of documents and records (including the rules of the National Center for Archives and Records), and the existence of any ongoing proceedings or legal matters that necessitate continued retention.
  • Once the purpose of processing has been fulfilled and the applicable retention periods have expired, your personal data will be securely destroyed in a manner that prevents unauthorized access, recovery, or misuse. Alternatively, it may be permanently anonymized so that you can no longer be identified from it.

1.8 Personal Data Security

The University is committed to implementing appropriate security controls and measures to protect your personal data against loss, unlawful use, unauthorized access, alteration, disclosure, or unlawful destruction, in accordance with the controls and requirements issued by the National Cybersecurity Authority.

In the event of a personal data breach that is likely to cause harm to you, compromise your personal data, or adversely affect your rights or interests, we will notify you without undue delay in clear and understandable language. Such notification will include a description of the incident, the potential risks, the measures taken to address the incident, and the recommendations necessary to help protect you. The competent authority (SDAIA) will also be notified in accordance with the applicable legal and regulatory requirements.

1.9 Rights of the Personal Data Subject

In accordance with the Personal Data Protection Law (PDPL) and its Implementing Regulations, the Personal Data Subject is entitled, where applicable, to the following rights:

  • Right to Be Informed: You have the right to be informed of the legal basis for collecting your personal data and the purpose of such collection. Your personal data will not subsequently be processed in a manner inconsistent with that purpose.
  • Right of Access to Your Personal Data: You have the right to access and review your personal data held by the University, without prejudice to any restrictions prescribed by applicable laws or the rights of others.
  • Right to Obtain Your Personal Data: You may request a copy of your personal data in a clear, readable format and, where technically feasible, in a commonly used electronic format.
  • Right to Rectification: You have the right to request the correction, completion, or updating of your personal data whenever it is inaccurate, incomplete, or outdated.
  • Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, unless there is a legal basis requiring its retention.
  • Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time, unless the processing is based on another lawful basis.

Except as otherwise provided by applicable law, you will not be required to pay any fees to exercise these rights. Where a request is submitted to exercise any of these rights, the University will respond within thirty (30) days from the date of receipt of a complete request.

For further information regarding the processing of your personal data or the procedures for exercising your rights, you may contact the University's Personal Data Protection Officer using the contact details provided in this Policy.

1.10 Cookies

The University's websites and digital services use cookies and similar technologies to enhance the user experience, measure performance, and improve its digital services.

You may manage, delete, or disable cookies through your browser or device settings. However, please note that disabling certain cookies may affect the functionality and performance of some of the services provided.

1.11 External Links

The University's websites and digital services may contain links to external websites or services for reference or integration purposes. Such websites and services are governed by their own privacy policies, and the University assumes no responsibility for their content or data protection practices. We encourage you to review the privacy policies of those third parties before providing them with any personal data.

1.12 Contact Information

For inquiries or complaints related to privacy, personal data protection, the University's practices for handling personal data, or to exercise the rights of Personal Data Subjects, including requests for access, correction, or deletion where permitted by applicable laws, you may contact the University's Data Management Office or Personal Data Protection Officer.

Name: Muadh Mafrah Al-Shehri

Position: Personal Data Protection Officer

Email: mmsalshehri1@kau.edu.sa

1.13 How to Submit a Complaint or Objection

In the event of any concerns or non-compliance with the Personal Data Protection Law, you may submit a complaint to the University's Data Management Office through the official email address of the Office.

DMO@kau.edu.sa

If you are not satisfied with our handling of your complaint, or if we do not respond within two (2) business days, you may submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA).

Glossary

For the purpose of implementing this Policy, the meanings of the key words and terms used herein have been defined. Wherever these terms appear, they shall carry the meanings specified below unless the context requires otherwise. These terms are as follows:

University:

King Abdulaziz University.

Law:

The Personal Data Protection Law.

Competent Authority:

The Saudi Data and Artificial Intelligence Authority (SDAIA), which is the authority responsible for supervising the implementation of the Law and its Regulations in the Kingdom.

Data:

A collection of facts in their original or unstructured form, such as numbers, letters, still images, videos, audio recordings, or emojis.

Personal Data:

Any data, regardless of its source or form, that may lead to identifying an individual specifically or make it possible to identify them directly or indirectly. This includes, but is not limited to: name, personal identification number, addresses, contact numbers, license and record numbers, personal assets, bank account numbers, credit card numbers, still or moving images of an individual, and other data of a personal nature.

Sensitive Data:

Any personal data relating to an individual's racial or ethnic origin, religious, intellectual, or political beliefs, security and criminal records, biometric data, genetic data, health data, or data indicating that an individual is of unknown parentage or has unknown parents.

Processing:

Any operation performed on personal data by any means, whether manual or automated. This includes, but is not limited to, collection, recording, storage, modification, use, sharing, disclosure, transfer, and destruction.

Personal Data Subject:

The individual to whom the personal data relates, or their legal representative, or the person who has legal guardianship over them.

Processor:

Any entity that processes personal data on behalf of the University and for its benefit, in accordance with its legal and contractual instructions.

Electronic Services:

All services, systems, platforms, websites, or digital applications provided or supervised by the University.

Cookies:

Small text files stored on the user's device when browsing websites for the purposes of operating the website, improving the user experience, and measuring performance.

Consent:

The Personal Data Subject's acceptance of the processing of their personal data, given through a free and clear expression of will that indicates acceptance and cannot reasonably be interpreted otherwise. Such consent shall be documented, verifiable, and separate for each processing purpose.