For Saudi clinics, patient photography consent starts with the purpose of the photograph. Care, teaching and advertising need different decisions. Where consent is the basis for processing sensitive data, it must be explicit and recorded. A signed form does not override a legal restriction on the intended use.
Marketing needs particular care: Article 26 of Saudi Arabia’s Personal Data Protection Law (PDPL) excludes sensitive data from marketing processing. SDAIA confirms that this restriction applies even with consent. Identifiable photographs that reveal a patient’s treatment or health should not be treated as marketing-ready because the patient signed a release.
A plastic surgery follow-up, a dermatology teaching session and an Instagram post may use the same photograph. They do not have the same purpose or audience. This guide helps clinic teams separate those decisions and keep a useful record of what was explained and agreed.
General information for Saudi clinics, not legal advice or an approved consent-form template. Have your privacy lead or Saudi legal adviser review your clinic’s process.
When is a patient photograph sensitive data?
A photograph may identify someone directly, or through details linked to it. A face, distinctive tattoo, patient name, appointment details or a recognisable combination of features can make identification possible. In a clinical setting, the image and its context may reveal health information.
Treat identifiable images showing a diagnosis, treatment or recovery as sensitive health information. Removing a name or covering the eyes is not, by itself, proof that an image is anonymous. See the PDPL definitions and health-data safeguards.
Separate care, teaching and marketing
| Purpose | Typical example | Practical decision |
|---|---|---|
| Clinical care | Documenting a wound, recording a baseline or comparing recovery photographs. | Explain why the image is needed. Record consent where that is the legal basis, or document the applicable exception. Limit access to the care purpose. |
| Teaching | Showing a case in staff training or a professional presentation. | Assess the separate purpose, audience and disclosure. Use only the information needed and obtain appropriate permission or establish another lawful basis. |
| Marketing | Using an identifiable treatment photograph to promote the clinic on a website or social media. | Do not assume a marketing release makes sensitive-data processing lawful. Apply the PDPL restriction and obtain a Saudi legal review before any proposed use. |
Clinical consent should not quietly become permission for every future use. A patient agreeing to photographs for their care has not thereby agreed to an external teaching presentation or promotional campaign.
How to record patient photography consent in Saudi Arabia
Start before opening the camera. Explain the purpose in language the patient understands, invite questions and record the decision in the patient record. When relying on consent for sensitive-data processing, obtain explicit consent. The PDPL Implementing Regulation, Article 11, requires clear purposes, separate consent for each purpose and evidence of consent.
A practical consent record should identify the patient, the specific photography purpose, the explanation provided, the decision, the date and the staff member recording it. Keep the version of the information or form that the patient received. A signature without a clear explanation leaves an incomplete record.
Consent is not the only possible basis under the PDPL. If your clinic relies on a statutory exception for a necessary care activity, document why it applies. Do not label all clinical photography “optional consent” when your actual process relies on another basis.
What should you explain to the patient?
Use your privacy notice and a short photography explanation together. Before collection, make the following points clear:
- Who is responsible: the clinic’s identity and a contact for privacy questions.
- Why you need the photographs: the care purpose and the legal basis, plus any genuinely separate proposed use.
- What is required or optional: explain the consequences of declining a photograph needed for care. Do not make unrelated optional uses a condition of treatment.
- Who may receive or access them: relevant staff, service providers and any proposed external audience.
- Storage and retention: how the images are handled, the retention period or criteria, and any relevant processing outside Saudi Arabia.
- Patient rights: how to request access, correction or destruction where applicable, and how to withdraw consent for consent-based processing.
These points draw on the PDPL’s transparency requirements and the Implementing Regulation’s information requirements. Adapt them to what your clinic actually does. Do not promise deletion or local hosting that your operating process cannot deliver.
Why a marketing release is not enough
The PDPL’s marketing restriction is especially relevant to identifiable before-and-after photographs. Consent does not remove the restriction on processing sensitive data for marketing.
For example, a patient may be happy for a clinic to post a photograph showing treatment of a skin condition. Their willingness does not settle the PDPL question. The clinic still needs to assess whether it would be processing identifiable health data for marketing.
Do not assume that cropping, blurring or hiding the eyes resolves this. Genuine anonymisation requires that the person cannot be identified directly or indirectly. An anonymised illustration also still needs to satisfy applicable healthcare advertising rules. Ask your Saudi adviser to review the proposed material and use.
Read SDAIA’s PDPL common questions, particularly its explanation of sensitive-data processing, alongside Article 26 of the law.
Teaching needs its own decision
A closed staff-training session and an international conference have different audiences and risks. Specify who will see the image, whether copies will be distributed and whether the patient could be recognised. Use a non-identifiable alternative when it can meet the teaching need.
Do not assume that the PDPL’s research provisions automatically authorise teaching or public presentation. If identifiable images are proposed, have the clinic’s privacy lead assess the purpose, lawful basis and disclosure before sharing.
Photographs of children and patients who cannot consent
Where consent must be provided by a legal guardian, verify the guardian’s authority and document it. Explain the photography purpose and respect the patient’s interests and applicable capacity requirements. Do not assume that any accompanying adult can authorise every use. Article 13 of the Implementing Regulation addresses consent by a legal guardian.
What happens if a patient withdraws consent?
Make withdrawal requests easy to raise. Record the request, identify the affected photographs and uses, and stop the processing that depends on the withdrawn consent. Assess copies already shared and notify relevant recipients where required.
Withdrawal does not automatically erase the clinical record or make lawful earlier processing unlawful. A separate legal basis or retention duty may require the clinic to retain some images. Explain what will stop, what must be retained and why. Apply your documented retention policy rather than promising immediate deletion of every copy.
A six-point clinic checklist
- Define the photography purpose before capture.
- Confirm and record the lawful basis and any required explicit consent.
- Keep the consent record and its limits accessible with the patient record.
- Give only authorised staff the access and sharing permissions they need.
- Require a fresh review before teaching, disclosure or any proposed marketing use.
- Record withdrawal requests and apply the correct retention and deletion process.
Keeping the decision connected to the photographs
CureCast helps teams organise clinical photographs by patient and visit. Administrators can configure staff permissions, including download and sharing actions. Confidential patient controls and an audit trail support access management and review. Your clinic remains responsible for the legal basis, form wording and permitted use.
For new subscribing clinics, Saudi hosting can be arranged as part of deployment. Saudi hosting is not included during the free trial. Confirm the activation, primary storage, backups and support-access arrangements before uploading real patient data. See clinical photo management for Saudi clinics for the local workflow and onboarding discussion.
Frequently asked questions
Does a patient’s signature allow us to post their treatment photos?
No. A signature does not override the PDPL restriction on using sensitive data for marketing. Assess whether the photograph reveals identifiable health information and obtain Saudi legal advice on the proposed use.
Can we use clinical-care consent for a teaching presentation?
Do not assume so. Assess the teaching purpose, audience, identifiability and disclosure separately, and establish the appropriate permission or other lawful basis.
Must we delete clinical photographs when consent is withdrawn?
Not automatically. Stop the processing that depends on the withdrawn consent, then check whether another legal basis or retention obligation requires part of the clinical record to remain.
Official sources
- Saudi Personal Data Protection Law, especially Articles 1, 5–7, 12–13, 18, 23 and 26.
- SDAIA: Implementing Regulation of the PDPL, including information, anonymisation, consent, withdrawal and guardian provisions.
- SDAIA: PDPL common questions, including restrictions on processing sensitive data for marketing.
Review your clinic’s photo workflow
Discuss how your Saudi clinic captures photographs, controls access and keeps the right records available during follow-up.
Explore CureCast for Saudi clinicsDisclaimer: This post is general information, not legal advice, a certification or a guarantee of compliance with any law. Rules differ by country, state and type of practice. Check the official guidance that applies to you, and consult a qualified legal adviser if you are unsure.
