The Personal Data Protection Law (PDPL) is Saudi Arabia’s national data protection law. It sets the rules for how organisations may collect, use, store and share personal data — any information that identifies you, directly or indirectly. That includes photos and video of you, which is why it matters for camera systems like Rooya.
The law is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), and it has been fully enforced since September 2024. In plain terms, the PDPL means an organisation that handles your personal data must:
If you drive a vehicle fitted with a Rooya camera, footage and driving data that identify you are your personal data, and the PDPL protects them.
You are told what is recorded. Before monitoring starts, your employer explains what the cameras capture, why, and how the data is used. Rooya records road and cab video with driving events such as braking, speed and seatbelt use. There is no live feed to your manager, no audio recording, and nobody watching around the clock — footage is used when an event makes it relevant.
Your data is used for a defined purpose. The purpose is road safety, fair driver scoring and evidence when an incident happens — not general surveillance of your working day.
It is kept only as long as needed. Footage and events are retained under your employer’s retention policy and destroyed or anonymised when they are no longer required, unless another law requires them to be kept longer (for example while an insurance claim or legal case is open).
You keep rights over it. The full list is in the next section. As a driver, the quickest route is always through your employer’s fleet administrator, who coordinates directly with Rooya.
You have the right to:
Requests are handled within the timeframe set out in the PDPL, generally 30 days, which may be extended where the law permits.
If you are a driver monitored through the platform, please exercise these rights through your employer’s fleet administrator, who will coordinate directly with Rooya. If you are a website visitor or prospect, contact us directly using the details below.
We work with a limited number of infrastructure sub-processors, primarily our cloud hosting provider located inside the Kingdom of Saudi Arabia. Every sub-processor is bound by a data processing agreement that matches or exceeds the obligations required under the PDPL.
Rooya operates as a data processor for platform data and a data controller for website and prospect data, as set out above. We maintain a formal privacy program, a documented record of processing activities, mandatory staff privacy training, and an incident response plan. We conduct internal data protection impact assessments on product updates and track privacy risks through our internal risk register.
Questions about this page, or a request under the rights above, can be sent to info@rooya.ai.
Talk to the Rooya team about your fleet, your risk profile and the insight you need to make safer, smarter decisions.
No commitment. We’ll be in touch within one business day.