Saudi Arabia SDAIA AI Ethics Principles (Version 2.0, 2025) 2.PID: Privacy and Security in Prepare Input Data: lawful data handling, confidentiality and delegated authority, integrity and availability, contextual classification with de-identification, and backups

What does 2.PID require?

Data procurement, management and organisation uphold privacy law and standards; confidentiality restricts information to authorised persons under controls that govern delegation of authority; designers and engineers safeguard the accuracy and completeness of both information and processing and protect availability and storage through suitable secure database systems. All processed data is classified by business requirement, criticality and sensitivity so it receives matching protection, with developers and owners aware of the classification, classification done contextually so it does not itself reveal personal information, and de-identification applied according to classification and data protection law; backups and archiving follow the policies on continuity, disaster recovery and risk mitigation.