Privacy Notice
Last updated: January 2025
This Privacy Notice explains how we collect, use, store and protect your personal data in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia.
Data Controller
The data controller responsible for processing your personal data is the Ministry of Tourism of the Kingdom of Saudi Arabia. Our registered address is: Ministry of Tourism, King Abdulaziz Road, Riyadh, Kingdom of Saudi Arabia.
For any privacy-related enquiries, you may contact our Data Protection Officer by email at privacy@portal.gov.sa or by post to the address above.
Address: Ministry of Tourism, King Abdulaziz Road, Riyadh, Kingdom of Saudi Arabia
Email: privacy@portal.gov.sa
Data Residency and Storage
All personal data collected through this portal is stored and processed exclusively within the Kingdom of Saudi Arabia on NCA-licensed cloud infrastructure. We use only licensed cloud service providers that comply with the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls and are approved for government data processing within the Kingdom of Saudi Arabia.
Our infrastructure is hosted on NCA-licensed cloud infrastructure within the Kingdom of Saudi Arabia, ensuring full compliance with PDPL data localisation requirements. All data remains within KSA borders on NCA-licensed cloud infrastructure at all times.
Data We Collect
We may collect the following categories of personal data: name and contact information, usage data and analytics (with your consent), cookie preferences and consent records.
Purpose of Processing
Personal data is processed to: provide government digital services, improve the user experience of our portal, comply with legal and regulatory obligations, and respond to data subject requests.
Marketing Communications and Consent
We will only send you marketing communications where you have given your explicit prior consent to receive such communications from us as the sender. You have the right to opt-out of marketing communications at any time. To opt-out, you may: update your cookie preferences using the consent banner at the bottom of the page, click the unsubscribe link in any marketing email you receive, or contact us at privacy@portal.gov.sa. We will process your opt-out request promptly and no later than 10 business days. We do not share your personal data with third parties for direct marketing purposes without your explicit consent.
Your Data Subject Rights
Under the PDPL, you have the following data subject rights with respect to your personal data:
- Right to access your personal data – you may request a copy of the personal data we hold about you
- Right of correction and rectification of inaccurate or incomplete data
- Right of erasure and deletion (right to be forgotten) – you may request we delete your personal data where there is no lawful basis for continued processing
- Right of portability of your personal data in a structured, machine-readable format
- Right to object to processing of your personal data
- Right to restrict processing of your personal data
How to Exercise Your Rights
To exercise any of your data subject rights, please contact our Data Protection Officer. We will respond within 30 working days of receiving your request.
Contact Us
For data subject requests, privacy enquiries or complaints, please contact:
We aim to respond within 30 business days of receiving your request. Our response time is defined in our data subject request procedure.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to legal retention requirements.
Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction, in accordance with NCA Essential Cybersecurity Controls and licensed cloud infrastructure standards.