Prince Sultan Center for Defense Studies and Research
Prince Sultan Center for Defense Studies and Research was established by Council of Ministers Resolution No. (339) dated 16/8/1437 AH, which aims to strengthen and support the Kingdom's defense and security directions through conducting qualitative and technical research associated with defense, security, and strategic fields.
Pursuant to Paragraph No. (4.6) of Section Four of the Center's approved Personal Data Protection Policy regarding privacy notices, the Center is committed to applying the Personal Data Protection Law issued under Royal Decree No. (M/19) dated 09/02/1443 AH, amended by Royal Decree No. (M/148) dated 05/09/1444 AH, and its implementing regulations. Out of the Center's keenness on users' data and information, this Privacy Notice was prepared to provide the necessary protection and manage all personal data you share with us.
This Privacy Notice applies to all visitors, users, and others who access the Center's website or its mobile applications.
The purpose of this Privacy Notice is to inform you of the following:
Defining the nature and purpose of the information and data collected when using the Center's website or its mobile applications.
The Center's mechanism for using the collected personal data, and the entities with whom it is shared.
The rights guaranteed to you regarding your data as stipulated in the Personal Data Protection Law.
Data handled by Prince Sultan Center for Defense Studies and Research (the "Center") is considered one of its most vital assets to enhance performance and productivity and facilitate services for all. Therefore, the Center strives to implement best practices in data management and governance.
This Privacy Notice offers multiple advantages, including maintaining privacy and confidentiality and protecting individual rights, in addition to promoting transparency through effective governance.
Second: Purpose of Collecting Personal Data
Please note that the Center collects data upon your communication in order to deliver services, whether through the website or one of the mobile device applications.
A. Data provided directly by you:
The following data is collected directly during the procedures of providing electronic services (via the website and/or mobile applications and/or current or future digital portals).
Account Data: Data collected to create a personal profile, which includes, but is not limited to: name, identity information, email address, and mobile number.
Complaints and Inquiries Data: Data collected when submitting a complaint or inquiry, including, but not limited to: name, identity information, email address, mobile number, passport number, job title, and supporting documents that may contain personal data details.
Recruitment Data and Candidate CVs: Data collected from job applicants via the recruitment platform, which may include, but is not limited to: name, contact details, academic qualifications, practical experience, CVs, and any other documents or information provided by the candidate within the employment application that may contain personal data.
B. Automatically collected data:
The Center automatically collects certain non-personal data transmitted by your browser when visiting the Center's website or mobile applications, including, but not limited to:
Cookies
Location Data: The live coordinates of your location (when using mobile applications).
IP address (device protocol) through which the website is accessed.
C. Social media applications and external links.
The Center's website and/or mobile applications may contain links to social media platforms, including but not limited to X, Facebook, YouTube, and others, as well as external links to other websites. These external sites may collect information about you through providing their services, through cookies, or by using other tracking technologies, and your interactions with those sites and features may be subject to the privacy notices provided by their respective service providers.
Third: Personal Data to Be Collected
In general, the Center collects information and personal data directly from you, which may occur through your interactions with the Center's website:
Direct collection of personal data through the following:
1- Website: The Center's website provides an electronic communication service that requires collecting personal data to fulfill requests.
2- Email: Personal data sent to the Center via email is collected to respond to your requests and provide you with assistance.
Indirect collection of personal data through the following:
1- Third Parties: The Center may obtain information and personal data through an external source, such as government entities or service providers.
Fourth: Use of Personal Data
The Center uses personal data collected directly or indirectly to fulfill its obligations and responsibilities as the entity concerned with defense studies and research, including, but not limited to:
Benefiting from the various electronic services provided on the website and mobile applications.
Processing the complaints you submit, which may require sharing your personal data with customer support teams at the Center.
Utilizing personal data to evaluate job candidates, review employment applications, and verify the qualifications and experience provided.
Responding to your inquiries and providing you with further assistance.
Conducting quality assurance processes and improving the services we provide.
Fifth: Disclosure of Personal Data
The Center is committed to not sharing information with any other parties or third parties for marketing purposes. In the event of transferring personal data outside the Kingdom, the safeguards stipulated in the Regulation on Personal Data Transfer Outside the Kingdom will be applied.
The Center reserves the right to disclose personal data in the following cases:
1. Your consent to the disclosure of personal data through agreeing to use one of the electronic services.
2. Collecting personal data from a publicly available source.
3. If the entity requesting disclosure is a public authority and the request is made for security purposes, to execute the provisions of another law, or to meet any judicial or regulatory requirements in accordance with the provisions of the laws and regulations in the Kingdom.
4. If disclosure is necessary to protect public interest and safety, or to protect the lives of specific individuals.
5. Disclosure being limited to subsequent processing in a manner that does not lead to identifying you or any other specific individual.
Sixth: Legal Basis for Collecting and Processing Personal Data
Based on the Personal Data Protection Policy approved by the Center and prepared in accordance with the provisions of the Personal Data Protection Law and its Implementing Regulations, the legal grounds upon which we rely to process this data are:
Your explicit consent: which you provide to us to process personal data for a specific purpose communicated to you.
We may process personal data without obtaining your consent in the following cases:
A. If it is in your interest and there is difficulty in communicating with you or no response to communications sent by us.
B. Processing data based on your initial consent, or if the processing is compliant with the provisions of other regulations.
C. Data processing required for judicial and/or security purposes by public entities.
D. Execution of a statutory obligation: Compliance with the regulatory policies and Royal Decrees applicable to the Center.
E. Protection of vital interests: We may process your personal data to protect the vital interests of individuals in emergency situations related to life, health, or public safety.
F. Achieving public interest: We may process your personal data to achieve public interest objectives or in response to an official request from public authorities, as required by the laws and regulations.
G. Achieving legitimate interests: We process your personal data based on our legitimate interest in improving our services, provided that these interests do not override your legitimate rights.
H. If the personal data was collected from publicly available sources.
Seventh: Storage of Personal Data
Recognizing the importance of storing personal data on its systems, the Center works to protect this data and to securely delete it when it is no longer needed.
Personal data collected from the website and/or mobile applications is stored on servers located within the Kingdom and is subject to appropriate security technologies in accordance with the controls issued by the National Cybersecurity Authority in order to protect and preserve the data.
The Center disposes of personal data as soon as the purpose of its collection ends, through secure methods and technologies.
Retaining personal data beyond the purpose of its collection may be required in the following cases:
A. If there is a statutory justification authorizing us to retain it for a specified period under the Law or the laws and regulations in the Kingdom, or for security reasons.
B. If the personal data is closely linked to a case filed before the judicial authorities, and retaining it is necessary for this purpose.
C. In the event that all elements that could lead to discovering the identity of the data subject are anonymized or encrypted.
Eighth: Mandatory Nature of Collecting Personal Data and Potential Risks of Not Completing the Collection Process
The Center is committed to collecting the personal data necessary to provide its services and ensure the efficiency and quality of performance. Providing the required personal data is mandatory to complete the services and procedures offered by the Center, and failure to provide it is considered an obstacle to completing requests or obtaining services. The potential effects and risks resulting from not completing the personal data collection procedure include the following:
Inability to process the request or execute the service.
Inability to contact the user to update the status or respond to inquiries
Cancellation or rejection of the request in the event that the required data is not provided or incomplete data is provided.
Delay in executing procedures due to the lack of required data.
Restricted access to certain digital services that require authentication using personal data.
Ninth: Data Subject Rights Regarding the Processing of Personal Data
The Center exerts every possible effort to provide high-quality services to all users in a manner that guarantees their rights under the provisions stipulated in the Center's Personal Data Protection Policy, the Personal Data Protection Law, and the related laws and regulations, as follows:
Right to be Informed: You have the right to know about the personal data collection process and its uses, including the purposes of processing your data, the retention periods of that data, and the entities with whom the data will be shared. You can access these details by reviewing the Privacy Notice and filling out the Data Subject Rights Form or sending an email to the email of the Data Management Office at the Center.
Right to Access Your Personal Data: You have the right to access the personal data held by the Center, obtain a copy of it, or transfer it to another party. To exercise this right, fill out the Data Subject Rights Form on the Center's website or contact us via the email of the Data Management Office at the Center. Your request will be reviewed within 30 days, and you will be notified via email.
Right to Request Your Personal Data: You have the right to request to obtain your personal data available at the Center in a readable and clear format. To exercise this right, we hope you visit the Center's website or contact us via the email of the Data Management Office at the Center. Your request will be reviewed within 30 days and responded to via email.
Right to Correct Your Personal Data: You have the right to submit a request to the Center to correct your personal data that may be inaccurate, incorrect, or incomplete. To exercise this right, we hope you fill out the Data Subject Rights Form or contact us via the email of the Data Management Office at the Center. Your request will be reviewed within 30 days and responded to via email.
Right to Erase Your Personal Data: You have the right to submit a request to the Center to erase your personal data in the following cases:
If you believe that the purpose for which the data was collected has ended and it is no longer needed.
If an objection is submitted on legitimate grounds regarding our use of the personal data, for example:
If our use of the personal data conflicts with the provisions of the Law or other related regulations.
Withdrawing your consent to the collection and processing of personal data.
To exercise this right, we hope you fill out the Data Subject Rights Form or contact us via the email of the Data Management Office at the Center. Your request will be reviewed within 30 days and will be responded to via email.
Please note that the Center may retain certain records when necessary, in order to fulfill its duties as a governmental and security entity, and such retention is deemed necessary to comply with the statutory and legislative obligations in the Kingdom.
Right to Withdraw Consent to the Processing of Your Personal Data: You have the right to withdraw your consent to the processing of personal data — at any time — unless there are statutory justifications preventing that. To exercise this right, we hope you fill out the Data Subject Rights Form or contact us through the email of the Data Management Office at the Center.
The Center respects individuals' rights regarding their personal data, with certain exceptions stipulated in the Personal Data Protection Law, which are as follows:
Compliance with legislative and regulatory requirements.
Security or judicial grounds.
If access to this data would lead to the following:
Threatening the security of the Kingdom, harming its reputation, or conflicting with its interests.
Affecting the Kingdom's relations with other states.
Preventing the disclosure of a crime or affecting ongoing investigation procedures by the security authorities.
Protecting the data subject or others.
Endangering the safety of individuals.
Violating the privacy of an individual other than the data subject.
Conflicting with the interests of others.
For more details on how your personal data is processed and how to exercise your rights, you may contact the Personal Data Protection Officer at the Center via the email data.management@psdsarc.gov.sa .
Tenth: Personal Data Protection Officer
Users can exercise their rights by filling out the Data Subject Rights Form or by contacting the Personal Data Protection Officer at the Data Management Office of the Center via the email data.management@psdsarc.gov.sa .
Except as provided by law, you will not be required to pay any fees for exercising these rights. In the event a request is submitted to exercise one of these rights, you will receive a response within 30 days from the date of receiving the complete request.
Eleventh: Complaints and Inquiries
If you have any complaints, inquiries, or concerns regarding the Privacy Notice, how personal data is handled, or the Center's non-compliance with the provisions of the Personal Data Protection Law, you may contact our Personal Data Protection Officer via the email data.management@psdsarc.gov.sa .
We will cooperate with you to address all questions or issues you face regarding the collection and processing of personal data. In the event of dissatisfaction with the handling of the complaint, or if no response is received within fifteen business days, you may submit the complaint to the competent authority (the Saudi Data and Artificial Intelligence Authority), according to the mechanisms and channels available at the competent authority, as per the address of the Saudi Data and Artificial Intelligence Authority:
Saudi Data and Artificial Intelligence Authority (www.sdaia.gov.sa)
National Data Governance Platform (www.dgp.sdaia.gov.sa)
Twelfth: Review and Update
The Center's website management reserves the right to add or change any of the provisions of this Privacy Notice, and the website management will notify data subjects of any update to this notice. The website management has the right to terminate the data subject's account in the event that any change to the Privacy Notice is not accepted.
The notice is reviewed and updated annually or upon the occurrence of a material change, in order to ensure its adequacy, sufficiency, and effectiveness. Changes are tracked in the change log section.
This notice was created on 02/03/2026.
The notice was last updated on 02/03/2026.