Privacy Policy

The Ministry of Tourism (hereinafter referred to as the "Ministry") is the competent government authority responsible for regulating and developing the tourism sector in the Kingdom of Saudi Arabia, promoting its assets, and supporting its sustainable growth through the implementation of the Tourism Law, its Implementing Regulations, and other relevant policies.

The Ministry of Tourism may collect and process the Personal Data necessary based on the nature of the service provided by the Ministry or the applicable activity or initiative. Personal Data may include, but is not limited to, the following:

  • Identity and Personal Identification Data:

Such as name, national ID or residency number, nationality, date of birth, and other personal identification data.

  • Contact Data:

Such as telephone number, email address, postal address, and other contact information.

  • Account and Registration Data:

Such as username, login credentials, electronic accounts associated with the services provided, and other account and registration data.

  • Employment, Professional, or Educational Data:

Such as employer, job title, academic qualifications, relevant professional experience, and other employment, professional, or educational data.

  • Financial Data:

Such as payment information, bank account details, billing information, financial statements, and other financial information necessary for providing the service.

  • Technical Data:

Such as Internet Protocol (IP) address, device information, browser type, operating system, usage data, and other technical information.

  • Photographic, Audio, or Video Data:

Such as personal photographs, audio recordings, video recordings related to the service or activity, and other image or recording data.

  • Any other data, personal data, or sensitive data related to the nature of the service or activity.
  • Cookie Data.
  • Any data obtained from third parties.

The Personal Data referred to above may be mandatory as a whole or in part, depending on the nature of the service provided. The Ministry collects and processes only the minimum Personal Data necessary to achieve the specified purposes for which it is collected or processed, in accordance with the nature of the applicable service, activity, or initiative.

Where certain Personal Data is mandatory, failure to provide such data may affect the Ministry's ability to deliver the requested service or complete certain procedures.

Personal data related to the applicable service, activity, or initiative is processed for the purposes specified for its collection and in accordance with applicable laws, regulations, and instructions.

The purposes of collecting and processing personal data may include, but are not limited to, the following:

  • Providing, operating, managing, developing, and improving services, activities, events, and initiatives, such as issuing licenses, permits, and certificates; delivering training or educational programs; implementing initiatives and events; and managing accounts, records, and identity verification.
  • Communicating with Data Subjects or target audiences, such as sending notifications, awareness and promotional communications and sessions, surveys and questionnaires, and receiving and handling requests, inquiries, complaints, and reports.
  • Conducting studies, research, and analyses; preparing reports, statistics, and indicators; and supporting planning, development, decision-making, and the improvement of services and activities.
  • Fulfilling legal, regulatory, supervisory, security, and operational requirements and obligations, ensuring compliance with applicable laws, regulations, policies, and instructions, and implementing directives issued to the Ministry.
  • Integrating and exchanging data, and forwarding requests to relevant entities, where necessary to achieve the purposes of processing or to fulfill legal or operational requirements.
  • Any other purposes related to the Ministry of Tourism's functions or to the nature of the applicable service, activity, or initiative.

The Ministry of Tourism may collect Personal Data relating to the applicable service, activity, or initiative directly or indirectly from the Data Subject, the Data Subject's authorized representative, or from other available sources, depending on the nature of the service or the purpose of processing.

▪ Directly from the Data Subject:

This may include, but is not limited to, collection through the various channels made available by the Ministry, such as electronic forms, registration for services, websites, platforms, surveys, email communications, complaint tickets submitted by Data Subjects, telephone calls, field or in-person visits, or any other means relevant to the nature of the service or activity.

▪ Indirectly:

This may include, but is not limited to, collection through Cookies, analytics, data integration and data exchange with relevant entities, publicly available sources, or any other available sources.

By accessing or using the Ministry's websites, platforms, or services, the Data Subject acknowledges that the Ministry may obtain Personal Data from relevant entities or from other legally available sources, in accordance with this Privacy Policy and the applicable laws, regulations, and instructions.

Personal data is processed in accordance with lawful bases and in a manner proportionate to the purpose of processing and the nature of the applicable service, activity, or initiative, including but not limited to the following:

  • The consent of the personal data subject or their representative, where obtaining consent is the appropriate lawful basis for processing.
  • Compliance with a legal obligation or regulatory requirement that authorizes the Ministry to collect or process personal data pursuant to applicable laws, regulations, or instructions.
  • Performance of a contractual obligation where the personal data subject is a party to an agreement.
  • Pursuing a legitimate interest of the Ministry, the personal data subject, or another party, where the processing is necessary to achieve such interest.
  • Serving a public interest related to the Ministry’s statutory functions and responsibilities or the performance of its regulatory, supervisory, service-related, or other duties.
  • Protecting the vital interests of individuals where processing is necessary to safeguard their health, safety, or life.
  • Compliance with judicial or security requirements or any other requirements prescribed by applicable laws, regulations, and instructions.
  • Any other lawful basis permitted under applicable laws, regulations, and instructions and determined by the Ministry.

The Ministry of Tourism may rely on one or more lawful bases for processing Personal Data, depending on the nature of Personal Data and the purpose for which it is collected or processed. The Ministry may also rely on any other lawful basis permitted under the applicable laws, regulations, and instructions, including any lawful basis that may be introduced or amended in the future.

Personal Data may also be processed in the cases prescribed by law where the data has been collected from a publicly available source or where the data has been anonymized, in accordance with the applicable laws, regulations, and instructions.

Personal Data may be processed using electronic or manual means through any type of artificial intelligence, systems and technologies approved by the Ministry of Tourism or by service providers, to the extent necessary to achieve the specified purposes for the collection and processing of Personal Data.

Processing activities may include depending on the nature of the applicable service, activity, or initiative—the collection, recording, organization, structuring, storage, modification, updating, retrieval, use, sharing, transmission, archiving, destruction, or any other operation performed on Personal Data.

The Ministry of Tourism may share or disclose Personal Data with government entities, semi-government entities, partners, service providers, or other relevant entities, to the extent necessary to achieve the purposes related to providing the service or fulfilling legal requirements, or for other purposes related to the nature of the applicable service, activity, or initiative.

Personal Data may be shared or disclosed on an ongoing basis or when necessary, only to the extent required to achieve the purpose of such sharing or disclosure, and in accordance with the applicable laws, regulations, and instructions.

Personal Data may be stored on systems, servers, platforms, or technology services used by the Ministry of Tourism or by service providers hosting or delivering the relevant services, whether within or outside the Kingdom of Saudi Arabia, in accordance with the applicable laws, regulations, and instructions.

The Ministry of Tourism retains Personal Data for as long as necessary to fulfill the purposes for which it was collected or processed, or to comply with the applicable legal, regulatory, and operational requirements, in accordance with the applicable laws, regulations, instructions, and policies.

Retention periods may vary depending on the type and category of Personal Data, the purpose for which it is collected or processed, and the applicable legal requirements. Such periods may extend up to (50) years in aggregate across the Ministry’s internal units, except for records governed by the Unified Regulation for Administrative Documents and Archives, which can be retained permanently.

Once the purpose for collecting the Personal Data has been fulfilled or the applicable retention period has expired, the Personal Data will be destroyed or otherwise disposed of in a manner that prevents unauthorized access or recovery, unless legal requirements or legitimate justifications require its retention for a longer period. This shall be without prejudice to the retention periods applicable to each category of personal data in accordance with relevant operational, business, contractual, and regulatory requirements, as well as applicable internal and national laws and regulations.

The Ministry of Tourism implements appropriate administrative, organizational, technical, and security measures to protect Personal Data.

Personal data subjects are entitled to the rights provided under applicable laws, regulations, and instructions, which may include:

  • The Right to Be Informed, provided that exercising this right does not adversely affect the Ministry’s operations, the purpose for which the data was collected, and is exercised in accordance with the relevant controls, procedures, and policies.
  • The Right of Access to Personal Data, provided that exercising this right does not adversely affect the Ministry’s operations, the purpose for which the data was collected, and is exercised in accordance with the relevant controls, procedures, and policies.
  • The Right to request a copy of the Personal Data available to the Ministry, provided that exercising this right does not adversely affect the Ministry's operations or the purposes for which the Personal Data was collected, and is exercised in accordance with the applicable controls, procedures, and policies.
  • The Right to Request Correction, Updating, or Completion of Personal Data, provided that exercising this right does not adversely affect the Ministry’s operations, the purpose for which the data was collected, and is exercised in accordance with the relevant controls, procedures, and policies.
  • The Right to Request Destruction of Personal Data in cases permitted by law, provided that exercising this right does not adversely affect the Ministry’s operations, the purpose for which the data was collected, and is exercised in accordance with the relevant controls, procedures, and policies.

To exercise these rights, you may contact the Ministry of Tourism through the approved channels set out in the "Contact Us" section of this Privacy Policy.

Requests are reviewed and processed in accordance with the applicable laws, regulations, and the Ministry's approved procedures. A response will be provided within sixty (60) days from the date a complete request is received. This period may be extended where permitted under the applicable legal requirements.

Where processing is based on the Data Subject's consent, the Data Subject may withdraw such consent through the Ministry's approved channels. Such withdrawal shall not affect the lawfulness of any processing carried out prior to the withdrawal, unless another legal basis permits the continuation of the processing.

The services, activities, and transactions relating to Personal Data are subject to the applicable laws, regulations, instructions, and procedures in force in the Kingdom of Saudi Arabia. The Ministry may refuse or restrict its response to certain requests where fulfilling such requests would conflict with legal or security requirements, the rights of other parties, or as otherwise deemed appropriate by the Ministry.

If you have a complaint or objection relating to the processing of Personal Data or the exercise of your rights, you may submit your complaint or objection to the relevant department within the Ministry of Tourism through the approved channels set out in the "Contact Us" section of this Privacy Policy.

The Ministry of Tourism will review and process complaints and objections and respond within the applicable timeframe, in accordance with the applicable laws, regulations, and procedures.

If you are not satisfied with the outcome of your complaint or objection, or if you do not receive a response within the prescribed statutory period, you may submit a complaint to the competent authority: Saudi Data and Artificial Intelligence Authority (SDAIA).

Address: Riyadh, Kingdom of Saudi Arabia

Website: sdaia.gov.sa

National Data Governance Platform: dgp.sdaia.gov.sa

The Ministry of Tourism may use Cookies and similar technologies associated with the applicable website, platform, or service for the purpose of enhancing user experience, supporting website or platform functionality, understanding usage patterns, and improving services and digital content.

Information collected through such technologies may include technical information such as Internet Protocol (IP) addresses, browser type, operating system, and other information related to the use of the website, platform, or service.

Users may manage Cookie settings through their browser settings; however, disabling certain Cookies may affect the functionality or availability of certain website, platform, or service features.

The applicable website, platform, or service may contain links to external websites, platforms, or services operated by third parties, which are subject to their own privacy policies and practices.

This Privacy Policy applies solely to the applicable website, platform, or service and does not extend to external websites, platforms, or services operated by third parties.

Users are encouraged to review the privacy policies of such external entities before using their services or providing any personal data.

The Ministry of Tourism reserves the right to review, update, or amend this Privacy Policy from time to time in accordance with applicable laws, regulations, and instructions. To stay informed of any updates or amendments, please review this Policy by visiting this page periodically. Moreover, this Privacy Policy has been prepared in both Arabic and English. In the event of any discrepancy or inconsistency in the interpretation or meaning between the two versions, the Arabic version shall prevail.

Last Updated: July 2026

All updates made to this Policy are recorded in the change log below: Version - Date - Description of Change

  • 1.0 - July 2025 - Periodic review and update of purposes and policy provisions based on operational requirements, (including all versions issued under version 1.0)
  • 2.0 - July 2026 - Enhanced version of the Policy issued using the unified template in accordance with regulatory requirements.

If you wish to contact the Ministry or update your personal data or raise a complaint or objection in accordance with the Ministry’s applicable policies or procedures, you may contact customer care through:

▪ Phone number: 930

▪ Website: Ministry of Tourism Website

▪ Address: Kingdom of Saudi Arabia, Riyadh, Diplomatic Quarter, P.O. Box 66680, Postal Code 11586.

If you wish to exercise your rights, withdraw your consent, or contact the Personal Data Protection Officer, you may contact us through:

▪ Personal Data Protection Officer: Ms. Hissah Alharbi

▪ Email: [email protected]

▪ Data Subject Rights Request Form: DSR Form