Yes. The Saudi Personal Data Protection Law (PDPL) gives special protection to categories of data considered particularly sensitive. Under Article 7, 'Sensitive Data' — which includes health and medical information, biometric data, genetic data, religious beliefs, and other categories defined in the regulations — can only be processed under strict conditions.
For your sensitive data to be processed, you (or your legal guardian) must give explicit consent, or the processing must fall within a narrow set of permitted circumstances such as medical necessity, legal obligations, or vital public interest. This is a higher standard than for ordinary personal data, meaning companies cannot rely on vague justifications to handle your health records, fingerprints, or religious affiliation.
As an expat, this is particularly relevant in contexts like employment (where biometrics are commonly used for attendance), healthcare, and insurance. Always ask specifically how your sensitive data will be stored, who can access it, and whether it will be shared with third parties. You have the right under Article 9 to request this information. If a company cannot provide satisfactory answers, consider escalating to SDAIA, Saudi Arabia's data protection regulator.
This is general legal information, not legal advice. For advice on your specific situation, consult a lawyer licensed in Saudi Arabia.