Right to Access Information Policy
Key Principles and General Rules of Freedom of Information:
Scope
This Policy applies to all requests submitted by individuals to access or obtain unprotected public information produced by public entities, regardless of its source, form, or nature. This includes paper records, emails, information stored on computers, audio or video recordings, maps, photographs, manuscripts, handwritten documents, or any other form of recorded information.
The provisions of this Policy do not apply to protected information, including:
Information whose disclosure may harm national security, state policy, interests, or rights.
Military and security information.
Information and documents obtained under an agreement with another country and classified as protected.
Investigations, inquiries, enforcement activities, inspections, and surveillance related to a crime, violation, or threat.
Information containing recommendations, proposals, or consultations related to the issuance of legislation or a government decision that has not yet been issued.
Commercial, industrial, financial, or economic information whose disclosure may result in unlawful gain or avoidance of loss.
Scientific or technical research, or rights involving intellectual property, where disclosure may infringe moral rights.
Information related to competitions, tenders, and auctions where disclosure may undermine fair competition.
Information that is confidential or personal under another law, or that requires specific legal procedures to access or obtain.
Key Principles of Freedom of Information:
Principle One: Transparency
Individuals have the right to access information related to the activities of public entities in a manner that promotes integrity, transparency, and accountability.
Principle Two: Necessity and Proportionality
Any restrictions on requests to access or obtain protected information received, produced, or handled by public entities must be clearly and explicitly justified.
Principle Three: Disclosure Is the Default for Public Information
Every individual has the right to access unprotected public information. Applicants are not required to have a specific status or demonstrate a particular interest in the information in order to obtain it, and they will not be subject to legal liability for exercising this right.
Principle Four: Equality
All requests to access or obtain public information are handled equally and without discrimination among individuals.
Rights of Individuals Regarding Access to or Obtaining Public Information
First: The right to access or obtain any unprotected information held by any public entity.
Second: The right to know the reason for refusing a request to access or obtain the requested information.
Third: The right to appeal a decision refusing a request to access or obtain the requested information.
Obligations of Public Entities:
The public entity is responsible for preparing and implementing the policies and procedures governing the exercise of the right to access or obtain public information. The head of the entity is responsible for approving and adopting such policies and procedures.
The public entity must create an administrative unit linked to the data management offices of government agencies formed pursuant to Royal Order No. 59766 dated 20/11/1439 AH. The unit will be responsible for developing, documenting, and monitoring the implementation of policies and procedures approved by the entity’s senior management and related to the right of access to information. Its duties and responsibilities must include defining appropriate standards for determining data classification levels where such standards do not exist, in accordance with the Data Classification Policy, and using them as a primary reference when processing requests to access or obtain public information.
The public entity must identify and provide appropriate means, such as public information request forms, whether paper-based or electronic, through which individuals may request access to or obtain public information.
The public entity must verify the identity of individuals before granting them the right to access or obtain public information, in accordance with the controls approved by the National Cybersecurity Authority and other relevant agencies.
The entity must define the necessary criteria for determining fees associated with processing requests to access or obtain public information, based on the nature and volume of the data, the effort required, and the time involved, in accordance with the Data Monetization Policy.
The public entity must document all records of requests to access or obtain information and the decisions made in relation to those requests. Such records must be reviewed to address cases of misuse or failure to respond.
The public entity must prepare and document policies and procedures for retaining and disposing of request records in accordance with the laws and regulations relevant to the entity’s activities and operations.
The public entity must prepare and document the procedures required to manage, process, and document extension requests and rejected requests. It must also define the duties and responsibilities of the relevant team and the circumstances in which the regulatory authority and the Office must be notified, in accordance with the administrative hierarchy and the specified timeframe for processing requests.
The public entity must notify the individual in an appropriate manner if a request is rejected in whole or in part, explaining the reasons for the rejection, the right to appeal, and how to exercise that right within a period not exceeding 15 days from the date of the decision.
The public entity must develop awareness programs to promote a culture of transparency and raise awareness in accordance with the Freedom of Information policies and procedures approved by the entity’s senior management.
The public entity is responsible for periodically monitoring compliance with Freedom of Information policies and procedures and presenting the results to the head of the entity or their delegate. Corrective measures to be taken in cases of non-compliance must also be identified and documented, and the regulatory authority and the Office must be notified in accordance with the administrative hierarchy.
Key Steps for Accessing or Obtaining Information
Key Requirements for Requests to Access or Obtain Public Information:
The request must be submitted in writing or electronically.
The approved by the public entity must be completed.
The request must be made for the purpose of accessing or obtaining public information.
The request form must include details of how the final decision and notifications are to be sent to the individual, such as through the national address, email, the entity’s website, or other available means.
The request form must be submitted directly to the public entity.
Key Steps for Requesting Access to or Obtaining Public Information:
First: Requests are submitted by completing the , whether electronically or on paper, and submitting it to the public entity that holds the information.
Second: Within a specified period not exceeding 30 days from the date of receiving a request to access or obtain public information, the public entity must take one of the following decisions:
Approval:
If the public entity approves the request to access or obtain information in whole or in part, the individual must be notified in writing or electronically of the applicable fees. The public entity must then make the information available to the individual within a period not exceeding 10 business days from the date the payment is received.
Rejection:
If a request to access or obtain information is rejected, the rejection must be communicated in writing or electronically and must include the following:
Whether the request was rejected in whole or in part.
The reasons for the rejection, where possible.
The right to appeal the rejection and how to exercise that right.
Extension:
If a request to access information cannot be processed within the specified timeframe, the public entity must extend the response period for a reasonable period proportionate to the volume and nature of the requested information, for example, for an additional period not exceeding 30 days. The individual must be provided with the following:
Notice of the extension and the expected date for completing the request.
The reasons for the delay.
The right to appeal the extension and how to exercise that right.
Notification:
If the requested information is available on the entity’s website or does not fall within the entity’s jurisdiction, the individual must be notified in writing or electronically. The notification must include the following:
The type of notification, for example, that the requested data is available on the entity’s website or does not fall within the entity’s jurisdiction.
The right to appeal the notification and how to exercise that right.
Third: If an individual wishes to appeal a public entity’s decision to reject a request, they may submit a written or electronic appeal to the entity’s Office within a period not exceeding 10 business days from the date they receive the public entity’s decision. The appeal committee at the entity’s Office will review the request, make the appropriate decision, and notify the individual of the review fees. Such fees will be refunded if the committee approves the request and accepts the appeal.
General Provisions
First: Public entities must align this Policy with their regulatory documents, including policies and procedures, and circulate it to all entities affiliated with or linked to them in a manner that promotes integration and ensures the intended objectives of the Policy are achieved.
Second: Public entities must balance the right to access and obtain information with other necessary requirements for protecting national security and preserving the privacy of personal data.
Third: Public entities must comply with this Policy and periodically document compliance in accordance with the mechanisms and procedures determined by those entities following coordination.
Fourth: Regulatory authorities, following coordination with the Office, must develop the mechanisms, procedures, and controls related to handling complaints within a specified timeframe and in accordance with the administrative hierarchy.
Fifth: Public entities must notify the Office if a request to access or obtain public information is rejected or if the specified period for providing such information is extended, where the request falls within the scope of this Policy.
Sixth: When a public entity contracts with other parties, such as companies providing public services, it must periodically verify those parties’ compliance with this Policy in accordance with the mechanisms and procedures determined by the entity. This must also include any subsequent contracts entered into by those parties.
Seventh: Public entities may introduce additional rules for processing requests relating to specific types of public information based on their nature and sensitivity, following coordination with the Office.
Eighth: Public entities must prepare forms for accessing or obtaining public information, whether paper-based or electronic, specifying the required information and the available means for providing the requested information.
Freedom of Information and Open Data
Open data programs and policies around the world are generally developed to support national economic and innovation agendas. Making selected public information available and publishing it for researchers, entrepreneurs, innovators, and start-ups helps create an environment that supports business growth and reflects an open and transparent government.
Open data programs and policies also serve as a proactive measure by public entities to safeguard the right of access to public information by making selected information available or publishing it as open data before access is requested. Effective open data programs and policies therefore reduce the volume of requests to access public information, which in turn helps reduce government costs associated with processing such requests.
Related Legislation and Policies
In accordance with the National Data Governance Policies issued by the Saudi Data & AI Authority (SDAIA): Click Here to Download the Document.
Based on the National Data Governance Policies issued by the Saudi Data & AI Authority (SDAIA), the following principles are addressed:
Key Principles and General Rules of Freedom of Information.
Key Principles and General Rules of Open Data under these policies.
If you have any inquiries or feedback, you may contact us through the Unified Contact Page:
Click Here