Policy Of Use

Terms of Use

mewa.gov.sa is available to all users. By accessing this platform, you, as a user, are deemed to have agreed to all Terms of Use, including all applicable laws and regulations in the Kingdom of Saudi Arabia.

Registered User Rights

As a registered user, you have the right to:

• Access information.
• Obtain information.
• Correct or amend information.
• Withdraw consent and request the deletion of information by submitting a request via email or contacting us here.

As a data subject, you have the right to know the legal or practical basis relied upon for collecting your personal data, including being informed of such basis, and to ensure that your data is not subsequently processed in a manner that conflicts with the purpose for which it was collected or for any other incompatible purpose. You also have the right to request the destruction of your personal data available to us, without prejudice to the provisions of applicable laws.

User Restrictions

By accessing this platform, you agree to refrain from:

• Providing or uploading files containing unauthorized software, materials, or data, or any other information or files that may contain viruses.
• Using this platform to send any commercial or unsolicited emails, misusing the platform in any other manner, or publishing, advertising, distributing, or circulating defamatory materials or information, materials that violate applicable laws in the Kingdom, or any other unacceptable materials or information.
• Using this platform to engage in any illegal or unlawful activities in the Kingdom.
• Using the platform to advertise any product or service that may result in a violation of the laws or regulations in the Kingdom, or using any tool, software, or procedure that disrupts or may disrupt the operation of the platform.
• Taking any action that places an unreasonable load on the platform infrastructure or requires excessive storage capacity.

Termination of Use

We reserve the right, at our discretion, to restrict a user’s right to log in, or to suspend or terminate their use of the platform without prior notice and for any reason, including violation of the Terms of Use or any action that we consider unlawful or potentially harmful to others. The user will not be permitted to log in to the platform during the suspension or termination period.

Personal Data Processing and Consent

Except in cases provided for under applicable laws, personal data may not be processed, nor may the purpose of its processing be changed, without the consent of the data subject. The regulations specify the conditions for consent, the cases in which consent must be in writing, and the terms and conditions for obtaining the consent of a legal guardian if the data subject has limited or no legal capacity. However, consent may not be a condition for providing a service or benefit unless that service or benefit is related to the processing of personal data for which consent is required.

Comment and E-Participation Standards

All comments posted through e-participation channels or social media networks are carefully reviewed to ensure that users comply with the standards and regulations governing comments. The platform management has the right to exclude any comments considered inappropriate, and users are required to:

• Observe public morals and avoid inappropriate expressions or offensive language.
• Keep comments relevant to the topic and focused on the issue under discussion.
• Avoid intolerance and personal criticism that does not contribute to the discussion.
• Ensure the accuracy of Quranic texts or religious opinions when referring to them, and limit discussion of such topics to specialists.
• Avoid posting personal information, such as contact details, in comments.

Any further amendments to the Terms of Use will take effect immediately upon announcement, unless otherwise stated.

Data Breach

mewa.gov.sa must notify the competent authority immediately upon becoming aware of any breach, damage, or unlawful access to personal data. If any such incident is likely to cause serious harm to the data subject, the data subject will be notified immediately.

Communication

Except for awareness materials sent by public entities, mewa.gov.sa may not use personal communication channels, including postal and email addresses, to send advertising or awareness materials except in accordance with the following:

• The intended recipient’s consent must be obtained before sending such materials.
• The sender of the materials must provide a clear mechanism, as specified by the regulations, enabling the intended recipient to express their wish to stop receiving such materials at any time.

Marketing, Scientific, Research, and Statistical Purposes

Except for sensitive data, personal data may be processed for marketing purposes if it is collected directly from the data subject and consent is obtained in accordance with applicable laws. Personal data may also be collected or processed for scientific, research, or statistical purposes without the data subject’s consent only in the following cases:

• If the personal data does not contain any information that identifies the data subject.
• If the identity of the data subject is anonymized during processing and before disclosure to any other party, and the data is not sensitive data.
• If the collection or processing of personal data for such purposes is required under another law or for the implementation of a prior agreement to which the data subject is a party.

Official documents that identify the data subject may not be copied or reproduced unless this is required for the implementation of applicable laws or at the request of a competent public entity, as specified by the regulations.

Transfer of Data Outside the Kingdom

Except in cases of extreme necessity to preserve the life of the data subject, or to prevent, examine, or treat infectious diseases, mewa.gov.sa may not transfer personal data outside the Kingdom or disclose it to an entity outside the Kingdom unless this is required to fulfill an obligation under an agreement to which the Kingdom is a party, to serve the interests of the Kingdom, or for other purposes specified by the regulations, and after meeting the following conditions:

• The transfer or disclosure must not prejudice national security or the vital interests of the Kingdom.
• Adequate safeguards must be provided to preserve the confidentiality and protection of the personal data being transferred or disclosed, so that the level of personal data protection is no less than that provided under applicable laws and regulations.
• The transfer or disclosure must be limited to the minimum amount of personal data necessary.
• Approval of the competent authority for the transfer or disclosure must be obtained as specified by the regulations.

Except for the condition provided for herein, the competent authority may exempt mewa.gov.sa, on a case-by-case basis, from complying with one of the conditions if the competent authority determines, independently or in coordination with other parties, that the personal data will receive an acceptable level of protection outside the Kingdom, provided that such data is not sensitive data.

Records and Retention

This platform retains records for a period specified by the regulations, and such records must include, at a minimum, the following information:

• Contact details of the entity.
• The purpose of processing personal data.
• Categories of data subjects.
• The party to whom personal data has been or will be disclosed.
• Whether personal data has been or will be transferred outside the Kingdom or disclosed to a party outside the Kingdom.
• The expected retention period for personal data.

Offenses and Penalties

Without prejudice to any more severe penalty prescribed under another law, any person who commits a violation with the intent to harm the data subject or obtain a personal benefit will be punished by imprisonment for a period not exceeding two years, a fine not exceeding three million Saudi riyals, or both.

Any person who violates the provisions governing the transfer or disclosure of personal data outside the Kingdom will be punished by imprisonment for a period not exceeding one year, a fine not exceeding one million Saudi riyals, or both.

In cases where no specific provision is set out in the law, and without prejudice to any more severe penalty prescribed under another law, any natural or legal person subject to the law who violates any of its provisions or regulations will be punished with a warning or a fine not exceeding five million Saudi riyals. The fine may be doubled in the event of a repeated violation, even if it exceeds the maximum limit, provided that it does not exceed twice that limit.

The Public Prosecution is responsible for investigating and prosecuting these violations before the competent court. The competent court will consider cases arising from the application of this provision and impose the prescribed penalties.

One or more committees will be formed, each consisting of no fewer than three members, one of whom will be designated as chairperson, and including a Sharia or legal adviser. The committee will be responsible for considering violations and imposing the warning or fine prescribed herein, according to the type, seriousness, and impact of the violation. The head of the competent authority will issue a decision setting out the committee’s operating rules and determining the remuneration of its members. Any person against whom a committee decision is issued may appeal before the competent court.

Without prejudice to the provisions of this law, mewa.gov.sa will hold any of its employees disciplinarily accountable if they violate any provisions of the law or regulations, in accordance with the applicable accountability and disciplinary procedures.

Without prejudice to the penalties prescribed under the law, any person who suffers harm as a result of any violation provided for under the law or regulations may claim compensation before the competent court for material or moral damages in proportion to the extent of the harm.

Any person engaged in work involving the processing of personal data is also required to maintain the confidentiality of such data even after the end of their employment or contractual relationship.

Terms of Use

• All users must comply with the applicable laws and regulations in the Kingdom.
• Use of the systems and platforms constitutes explicit acceptance of the Terms of Use.
• Users must use the systems only for official and authorized purposes.

Acceptable Use Controls

Users must comply with the following:

• Use the systems safely and responsibly.
• Protect login credentials and do not share them.
• Report any suspicious activity or security vulnerabilities.
• Comply with privacy and data protection policies.

Restrictions on Use

Users are prohibited from:

• Uploading or publishing files containing malicious or unauthorized software.
• Sending unsolicited messages (Spam).
• Publishing illegal content or content that violates laws or public morals.
• Attempting to hack systems or test vulnerabilities without official authorization.
• Disrupting or affecting the performance of systems or services.
• Violating authentication or access controls.

Data Protection and Privacy

• Personal data is collected and processed in accordance with approved laws and with the consent of the data subject.
• Data may not be used for purposes other than those for which it was collected.
• Data protection controls must be applied during storage, processing, and transfer.

The data subject has the right to:

• Access their data.
• Correct or update their data.
• Request the deletion of their data in accordance with applicable laws.

Cybersecurity

• Antivirus and anti-malware software must be used.
• Identity and access management policies must be followed.
• The Least Privilege principle must be applied.
• Activities on systems must be monitored and logged.
• Cybersecurity incidents must be reported immediately.

Link and Content Management

• Portal content may not be copied or republished without authorization.
• Official links may be shared provided they are not misused.
• The Ministry is not responsible for third-party content.

Comments and E-Participation

The following must be observed:

• Public morals and respect for others.
• Avoiding the publication of personal information.
• Maintaining accuracy and credibility.
• Refraining from publishing offensive, extremist, or misleading content.

Transfer of Data Outside the Kingdom

Personal data may not be transferred outside the Kingdom except under the following conditions:

• Compliance with national laws and regulations.
• Provision of an equivalent level of protection.
• Obtaining the required regulatory approvals.
• Limiting the transfer to the minimum amount necessary.

Incident and Data Breach Management

• Any breach or intrusion must be reported immediately.
• The competent authorities will be notified in accordance with applicable regulatory requirements.
• Affected individuals will be notified in cases involving high risk.

Termination or Restriction of Access

The Ministry has the right to:

• Suspend or terminate user access in the event of a violation.
• Take the necessary legal action.
• Prevent re-registration in cases of serious violations.

Compliance and Penalties

Violators are subject to penalties in accordance with applicable laws and regulations.

Affected parties have the right to claim compensation.

Penalties include:

• Warnings.
• Financial fines.
• Imprisonment in serious cases.

Information Security Controls

• Restricting application user privileges to the minimum necessary based on their duties and the nature of their work.
• Implementing a security strategy that applies multiple layers of security controls across different levels of the Ministry’s technology infrastructure.
• Adopting a security model based on the principle of “Never Trust, Always Verify,” which assumes that security threats may exist both inside and outside the boundaries of the Ministry’s technology network.
• Establishing a comprehensive Identity and Access Management (IAM) framework to ensure that only authorized users and devices can access resources.
• Complying with relevant national standards, such as NCA, NDMO, DGA, CST, and SAMA, and international standards, such as ISO, NIST, Uptime Institute, and PCI-DSS, which contributes to keeping the Ministry aligned with updates, enhancing protection, and supporting the development of its operations.