Introduction:
The Ministry of Commerce is a public entity responsible for implementing commercial policies and driving commercial growth in the Kingdom in general, as well as executing the mandates of the Ministry of Commerce Law and other related commercial regulations in particular. The Ministry is also tasked with registering merchant information and trade names within the Kingdom, organizing methods to promote trade, overseeing the regulation of domestic markets, managing utilization and storage, controlling prices, and maintaining commercial balance within the Kingdom.
Additionally, the Ministry regulates import and export policies, examines customs tariffs and their impact on commercial activities, and studies and formulates draft trade agreements with other countries in coordination with the Ministry of Foreign Affairs. It also supervises the enforcement of the Companies Law, requests amendments to company regulations, and conducts inspections. The Ministry combats all forms of commercial fraud without limitation, oversees compliance, receives reports, detects violations, and combats concealment practices along with related commercial regulations. Furthermore, it supervises and regulates the e-commerce sector.
Data privacy is a top priority for the Ministry of Commerce, which makes every effort to maintain its confidentiality and protect it from unauthorized access or processing that does not comply with the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443H.
This policy has been established to clarify the types of personal data collected, the purpose of collecting it, the processing methods that will be applied, users' rights, and the mechanism for exercising those rights. The Ministry emphasizes the following:
• Data is collected only after obtaining consent to this policy.
• Data collection is limited to the minimum personal data necessary to fulfill the purposes stated in this policy.
• The policy is reviewed periodically to ensure its alignment with any changes in regulations and legislation. Users will be notified of any updates.
Approval to the Privacy Policy:
By consenting to this Privacy Policy, you agree to the terms and conditions governing data privacy applicable to all service channels offered by the Ministry, including any modifications to these terms and conditions from time to time.
Personal Data Collected and Purpose:
The Ministry collects the minimum necessary personal data—after obtaining consent—to carry out its functions as outlined in the introduction to this policy and to provide and manage services to beneficiaries efficiently. Data is collected both directly from users and indirectly as follows:
• Personal Data Collected Directly:
o Full Name
o Nationality
o Gender
o ID Type
o ID Number
o Date of Birth
o Contact Numbers
o Email Address
o Residential/Mailing Addresses and Location Coordinates
• Data Collected Indirectly:
o The Ministry’s systems record information about the electronic devices used to access the Ministry’s systems.
o The Ministry verifies the accuracy of personal data provided by users against the data available in the National Information Center.
o The Ministry inquiries about information, licenses, and services provided to commercial entities from all governmental, semi-governmental entities, and service providers in the Kingdom.
Purpose of Collecting and Processing Personal Data:
The Ministry uses users' personal data, collected both directly and indirectly, for the purposes specified in this policy, as well as for regulatory purposes outlined in the Personal Data Protection Law. The purposes for collecting and processing data include, but are not limited to:
• Supervising the regulation of domestic markets.
• Maintaining commercial balance within the Kingdom.
• Recording and updating registry information as specified by relevant laws and regulations.
• Monitoring companies' compliance with the provisions stipulated in the Companies Law and their articles of incorporation or bylaws.
• Detecting and preventing commercial concealment violations.
• Recording information about owners, partners, and related parties in commercial registries (e.g., managers, authorized representatives, board members, etc.).
• Verifying users' identities, contact details, and eligibility before accepting requests, complaints, or services submitted through the Ministry's portals.
• Receiving and processing requests or complaints and implementing related procedures.
• Managing and developing digital services.
Regulatory Basis for Collecting and Processing Personal Data:
• Explicit Consent: Consent is obtained before collecting personal data. Users may withdraw their consent at any time without affecting processing activities conducted based on other legal grounds, as outlined in the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 09/02/1443H.
• Ministry Of Commerce Law Issued by Royal Decree No. (1/568) dated 09/11/1374H.
• Commercial Register Law Issued by Royal Decree No. (M/83) dated 19/03/1446H.
• Companies Law Issued by Royal Decree No. (M/132) dated 01/12/1443H.
• Anti-Concealment Law Issued by Royal Decree No. (M/4) dated 01/01/1442H.
Storage of Personal Data:
The Ministry stores personal data within the Kingdom of Saudi Arabia in a secure and reliable environment that complies with the National Cybersecurity Authority's regulations and related national legislation. In addition, administrative, organizational, and technical safeguards—aligned with relevant national laws—are implemented to protect personal data during storage. The data is retained according to legal obligations and is destroyed once the purpose of collection is fulfilled.
Sharing Data with Third Parties:
Personal data is not disclosed to third parties without obtaining the data subject's consent through the Ministry or its service providers unless a legal basis justifies the sharing of such data.
User Rights Regarding Personal Data Processing:
• Right to be Informed: Users have the right to be informed about the legal basis for collecting personal data, the purpose of the collection, and to ensure that data is not processed in a manner incompatible with the purpose of its collection or in circumstances other than those specified in Article (10) of the Personal Data Protection Law.
• Right of Access: Users have the right to access their personal data and obtain a copy of it.
• Right to Request Data Correction: If personal data is inaccurate, users have the right to request its correction and to complete any incomplete personal data based on the information they provide.
• Right to Request Data Deletion: Users have the right to request the deletion of their personal data if any of the following conditions are met:
o The personal data is no longer necessary for the purpose for which it was collected.
o The user withdraws consent, and there is no other legal basis for processing.
o The user objects to the processing of personal data.
o The personal data was processed unlawfully.
o For compliance reasons, such as fulfilling the Ministry's legal obligations.
• Right to File a Complaint: Users have the right to file a complaint with the relevant authority regarding the application of the provisions of the Personal Data Protection Law.
• Right to Withdraw Consent: Users have the right to withdraw their consent to the processing of personal data at any time, unless there are legal grounds that require otherwise.
For more details on how your personal data is processed and how to exercise your rights, please contact the Ministry’s team using the contact information provided in this policy.
Contacting with MC team:
• In-person:
- Ministry of Commerce Building (King Abdulaziz Road, Riyadh 11162, Kingdom of Saudi Arabia Phone: 2944444)
• Data Management Office: DMO@MC.gov.sa
• Customer Service:
o 1900
o CS@mc.gov.sa