Privacy Policy

Privacy Policy

The Saudi Food and Drug Authority (SFDA) was established by Cabinet Decision No. (1) dated 07/01/1424 AH as an independent legal entity directly linked to the Prime Minister. The primary purpose of the authority is to regulate and oversee food and drug safety through establishing mandatory and non-mandatory standards for food, drugs, and related products, inspecting and monitoring these products in its laboratories or other approved laboratories, and raising consumer awareness about food and drug-related matters.



Recognizing the importance of protecting your personal data as a fundamental principle, we respect and value the privacy of the SFDA’s website users along with its services and platforms. Personal data collection and use will comply with the Personal Data Protection Law (PDPL), under which the SFDA acts as the data controller (responsible for determining the purposes and means of processing personal data). This policy aims to help you understand the nature of personal data we process, why and how we collect and process it, how we store it, and your rights concerning your data and how to exercise those rights.



This policy applies to all users and visitors (referred to as "users," "data subjects," or "you" or “your”) who access or use the SFDA’s website or services.



Definitions

  • SFDA: Saudi Food and Drug Authority
  • Law or PDPL: Personal Data Protection Law
  • Personal Data: Any data, regardless of its source or form, that identifies an individual directly or indirectly
  • Processing: Any operation performed on personal data by manual or automated means, including collection, destruction, disclosure, etc.
  • Collection: Obtaining personal data in accordance with the PDPL, either directly from the data subject, their representative, legal guardian, or other authorized sources.
  • Destruction: Any action that removes personal data and renders it irretrievable.
  • Disclosure: Making personal data accessible to any party other than the data controller for any purpose
  • Data Subject: The user or visitor to whom the personal data pertains, their representative, or their legal guardian.


Contact Information

  • Responsible Office: Data Management Office – Personal Data Protection Officer
  • Address: Riyadh, Kingdom of Saudi Arabia
  • Phone Number: 19999
  • Email Address: 19999@sfda.gov.sa


Last Updated Date

We recommend periodically reviewing this Privacy Policy to stay informed of any updates. The most recent update was on January 8, 2025.





What Personal Data Do We Collect?

  • Identity Data: Name, date of birth, gender, ID number, and personal identification documents.
  • Account Data: Information provided during registration on SFDA Services.
  • Payment Data: Data collected for processing payments.
  • Cookie Data: Data collected through website logs, cookies, or other tracking technologies, such as IP address, browser type and version, operating system, login details, browsing history, internet traffic data, and other online identifiers.
  • Contact Data: Email address, phone number, and mobile number.
  • Geolocation Data: National address and brief location details.




How and Why Do We Collect Your Personal Data?

We collect personal data directly or indirectly through the following methods:

  • Direct Methods: Using SFDA’s Services, contacting us, making inquiries, or any other form of communication.
  • Indirect Methods: Using cookies and other tracking technologies when you visit our website.

We collect your data for specific purposes, such as providing services, responding to inquiries, or handling complaints.





How Do We Disclose Your Personal Data?

SFDA adheres to data-sharing policies and regulatory frameworks. We do not share personal data with third parties outside the SFDA, except under specific conditions outlined in the PDPL, such as:

  • Obtaining your prior consent.
  • Disclosing data for lawful and defined purposes.




Legal Basis for Collecting and Processing Personal Data

Under the PDPL, the legal bases for processing your personal data include:

  • Your Explicit Consent: You may withdraw consent at any time without affecting lawful processing based on other grounds.
  • Contractual Obligation: Processing may be required to fulfill contractual commitments, such as providing requested services.
  • Statutory Obligation: As mandated by Article 5 of the Royal Decree No. M/6 dated 25/01/1428 AH.
  • Vital Interest Protection: To safeguard public health or prevent harm to individuals and society.
  • Public Interest: Ensuring the safety of food and drugs through monitoring and enforcement.




How Do We Store Your Personal Data?

Your personal data is securely stored at SFDA’s premises or within cloud services located in the Kingdom of Saudi Arabia. Personal data will be retained only under the following circumstances:

  • If required by law or regulation for a specified period.
  • If relevant to ongoing legal proceedings, in which case it will be securely destroyed after the conclusion of the case.

Upon data retention expiry, secure deletion methods, including database overwrites and physical shredding for paper records, are employed to ensure irretrievability.





Your Rights Regarding Your Personal Data

Under the PDPL, you have the following rights:

  1. Right to Information: Be informed about the legal basis and purpose of data collection.
  2. Right to Access: Access your personal data stored by SFDA.
  3. Right to Rectification: Request corrections to inaccurate or incomplete data.
  4. Right to Destruction: Request destruction of data no longer needed, subject to Article 18 of the PDPL.
  5. Right to Withdraw Consent: Revoke consent for processing unless required otherwise by law.
  6. Right to Data Portability: Request a readable and clear copy of your personal data.

For more details, contact the Personal Data Protection Officer using the details above.





How to File a Complaint or Objection

If you have concerns or believe SFDA has not adhered to the PDPL, you may file a complaint with the Data Management Office. If unresolved within 30 business days, you may escalate the complaint to the Saudi Data and Artificial Intelligence Authority (SDAIA).



SDAIA Contact Information