Saudi Arabia SDAIA AI Ethics Principles (Version 2.0, 2025) 2.PD: Privacy and Security in Plan and Design: privacy-respecting design, minimal personal data, approved profiling only, security blueprint, applicable standards, data classification and de-identification planning

What does 2.PD require?

The system and its algorithm are configured so individual privacy is protected, personal data is not misused and decision criteria do not rest on personally identifying characteristics. Personal information is limited to what the system needs to function, and designs that profile individuals or communities proceed only with approval of the Chief Compliance and Ethics Officer or Compliance Officer or under a sector regulator's code of ethics. The security and protection blueprint for data and algorithm follows best practice to withstand cyber attack and breach attempts; the legal frameworks and standards on privacy and security are followed and tailored to the use case; data classification and profiling define protection levels and permitted use; and de-identification mechanisms and read, write and update authorisation for relevant groups are planned.