Your rights under the PDPL

TEPCO KSA is the controller of the personal data collected through tepco-ksa.com, and the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia governs how we handle it. The rights below belong to any identified or identifiable person whose personal data we hold.

This page explains those rights and how to exercise them. For the detail of what we collect, why, the legal basis we rely on, and how long we keep it, see our privacy notice; the two documents are meant to be read together.

You have the right to know what personal data we collect about you, the purpose of collecting it, the legal basis for processing it, who we may share it with, and how long we keep it.

We meet this right through our privacy notice and by telling you, at the point of collection, why we are asking for your data and what we will do with it.

You have the right to confirmation of whether we process your personal data and to access the data we hold about you.

To exercise it, email our privacy team. We verify your identity to protect your data, then respond within the period set by the PDPL.

You have the right to obtain your personal data in a clear, commonly used format. Where it is technically feasible, we provide it in a structured electronic file so you can read it or move it elsewhere.

You have the right to have personal data that is inaccurate, incomplete, or out of date corrected or completed. Tell us what needs to change; we update it and, where required, notify any party we shared it with.

You have the right to request the destruction of personal data we no longer have a lawful basis to keep.

Where a regulation, contract, or accounting obligation requires us to retain certain data, we may keep it for that purpose only, and we will explain to you what we are retaining and why.

Where our processing relies on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it, and some services may no longer be available to you once consent is withdrawn.

There is one clear route: email our privacy team, naming the right you wish to exercise and giving enough detail for us to locate your data.

We verify your identity before acting, which protects you from someone else accessing your data, and we may ask for clarification so we answer the right you actually intend.

We respond to verified requests within the period set by the PDPL and its regulations. Your first request is free.

We may charge a reasonable fee only for requests that are excessive or repetitive, and we will tell you the amount before any charge applies. If we cannot act on a request, we explain why and set out the options available to you.

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with the Saudi Data and AI Authority (SDAIA), the regulator for the PDPL. We would welcome the chance to resolve the matter with you first.

We may update this statement from time to time. We flag any material change, and the effective date shown at the top of the page always reflects the current version.