Privacy Policy

The Human Rights Commission was established by Cabinet Resolution No. (207) dated 8/8/1426 AH, as the competent government body in the Kingdom of Saudi Arabia concerned with protecting and promoting human rights, raising awareness of them, receiving related complaints and reports, and following up on their handling and resolution in accordance with its statutory mandate.

Based on the Human Rights Commission's commitment to protecting beneficiaries' data and information and its adherence to maintaining the confidentiality and privacy of personal data in accordance with relevant laws and regulations, this Privacy Policy has been prepared to clarify how personal data is collected and handled, the purposes of which it is collected, and the methods of sharing, exchanging, and storing it, in addition to the rights of data subjects.

This policy applies to all users and visitors (hereinafter referred to as "User" or "Data Subject") who have access to or use the Commission's website or its affiliated platforms.

To exercise your rights or make inquiries regarding your personal data or about what is stated in the Privacy Policy in general, or if you believe that your personal data has been compromised, you can contact us through the Contact Us page.

The Commission is committed to limiting the personal data collected and processed to the minimum amount necessary to enable it to perform its tasks and ensure the provision of the appropriate service to the beneficiaries, and includes the following mandatory data:

The Commission's website uses cookies to enhance your experience and provide personalised services. Cookies are used to improve user experience and website performance, support analytics, and protect user data. You can accept or reject cookies through your browser settings; however, rejecting cookies may prevent you from accessing all or some website services.

The legal basis for the Commission's processing of personal data is the fulfilment of its statutory obligations and requirements entrusted to it, in order to achieve any of the following purposes:

Failure to provide the required data may result in the following:

The Commission collects personal data from you directly through electronic forms (which specify whether the data to be collected is mandatory or optional), complaints or reports, email and telephone communications, and in-person visits to the Commission.

Personal data is also collected indirectly through the National Unified Platform (Nafath), cookie technologies, and electronic interconnection with other entities, in cases requiring the processing of requests related to the data subject, in accordance with applicable regulations and legislation.

Personal data collected from you, directly or indirectly, is processed to carry out the tasks and responsibilities entrusted to the Commission and in a manner that achieves the purposes specified in this policy. Personal data will only be processed by authorised personnel within the scope of their respective roles and responsibilities, in accordance with the policies adopted for this purpose. Failure to collect your personal data may affect your ability to benefit from the services provided by the Commission.

The Commission adheres to the data sharing policies and regulations issued by regulatory bodies and does not share personal data with any party outside the Commission except in the cases in which disclosure is permitted under the Personal Data Protection Law and its implementing regulations, whether with the data subject's prior consent or for the purposes and in the circumstances permitted by the Law.

Personal data is securely stored and saved on approved cloud servers within the Kingdom of Saudi Arabia. The best security standards and practices are applied to ensure data security and protection, in accordance with relevant regulations, policies, and the requirements of the National Cybersecurity Authority, such as: access management processes based on the principle of least privilege and need-to-know, data classification and encryption and the use of masking or redaction, periodic backups, audit logs, and regular security assessment procedures.

Data is retained for the periods necessary for the Commission's obligation to fulfil its regulatory obligations and until the purpose for which it was processed has been fulfilled, in accordance with the Commission's approved data and records retention policy and regulatory requirements. Afterwards, it is destroyed securely in a manner that prevents its retrieval or recovery and prevents the data from being retrieved or recovered or the data subject from being identified, in compliance with Article (18) of the Personal Data Protection Law.

The Commission adopts a rigorous approach to ensure the secure disposal of personal data using the latest digital data erasure technologies. This applies to data on physical storage media such as hard disks, CDs, external hard drives, mobile devices, portable drives, database records, and backup files. All paper data is destroyed using high-quality, secure shredders, and the paper is disposed of safely. The Commission prepares a detailed report on all data that has been disposed of, taking into account cybersecurity controls in the data destruction process.

Under the Personal Data Protection Law, the data subject has the following rights:

To submit a request regarding the rights mentioned above, you can do so by submitting the request through the Contact Us page. You will receive a response within a maximum period of thirty (30) days from the date of receipt of the complete request.

The Commission's website and its associated platforms and applications may contain links to other websites that may not be affiliated with the Commission. If you follow any of these links to access those websites, you should review their privacy policies. The Human Rights Commission assumes no responsibility for the data collection or protection practices of those websites.

In case you have a complaint or objection regarding the processing of your personal data, you can contact the Human Rights Commission's Privacy Management Team at the following email address: DP.DMO@HRC.GOV.SA. If the complaint is not handled satisfactorily, you can submit a complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the National Data Governance Platform.

For more information on the relevant regulations and legislation referenced in this policy, please refer to one of the following links: