Saudi PDPL Compliance Guide

The Saudi PDPL, the Personal Data Protection Law of the Kingdom of Saudi Arabia, is the country's general privacy law, modelled in many respects on the GDPR. It applies to organisations processing personal data in the Kingdom and to organisations outside it that process personal data of people living there. It took effect on 14 September 2023, with a one-year grace period, and has been fully enforceable since 14 September 2024.

The Saudi Data and Artificial Intelligence Authority (SDAIA) regulates the law and had issued 48 enforcement decisions by January 2026. In October 2026, SDAIA opened a consultation on further amendments to the Implementing Regulations. This guide explains who must comply, legal bases, rights, controller duties, breach notification, cross-border transfers, penalties and practical steps for technology companies.

What is the Saudi PDPL?

The PDPL was issued by Royal Decree M/19 in September 2021 and amended by Royal Decree M/148 in March 2023 before taking effect. It is supported by Implementing Regulations, which detail obligations, and Regulations on Personal Data Transfer outside the Kingdom. SDAIA, through its National Data Management Office, issues guidance and supervises compliance.

"Personal data" means any data that leads to identifying an individual, directly or indirectly. "Sensitive data" includes racial or ethnic origin, religious or political beliefs, criminal and security data, biometric and genetic data, health data, credit data, and data indicating that one or both parents are unknown.

Who must comply?

Public and private entities processing personal data in Saudi Arabia.
Entities outside the Kingdom that process personal data of residents of the Kingdom, including online service providers.
Processors acting on behalf of controllers, through contracts and direct obligations.

Processing by an individual for personal or family purposes is excluded.

Is it mandatory or voluntary?

Mandatory. There is no certification. SDAIA can investigate, issue warnings and fines, and refer serious cases for criminal penalties.

Legal bases for processing

Consent is the primary basis, and must be specific, clear, freely given and revocable. The PDPL and its regulations also allow processing without consent in defined cases, including:

processing that serves the data subject's actual interest when contacting them is impossible or difficult;
processing required by law or an agreement to which the data subject is party;
processing by public entities for security or judicial purposes;
legitimate interests of the controller, provided they do not prejudice the data subject's rights and do not involve sensitive data, supported by an assessment.

Sensitive data requires stricter handling, and some processing, such as for marketing, requires consent and opt-out mechanisms.

Data subject rights

The right to be informed about the legal basis and purpose of collection.
The right of access to their personal data and to obtain a copy in a readable, clear format.
The right to request correction, completion or updating.
The right to request destruction of data no longer needed.
The right to withdraw consent.

The Implementing Regulations set a response timeframe of 30 days, extendable in specified circumstances with notice.

Controller obligations

Privacy notice: a clear policy available to data subjects before collection, describing purposes, data, methods, storage, processing, destruction and rights.
Purpose limitation and minimisation: collect only what is necessary and use it for stated purposes.
Accuracy and retention: keep data accurate and destroy it when no longer needed, subject to legal retention requirements.
Security: appropriate organisational, administrative and technical measures, aligned with national cybersecurity controls where applicable.
Records of processing activities, maintained and available to SDAIA.
Processor selection and contracts, choosing processors with sufficient guarantees and binding them by contract.
Impact assessments for processing that poses high risk, such as large-scale sensitive data or new technologies.
Data protection officer appointment in specified cases, such as public entities, large-scale regular monitoring and core processing of sensitive data.
Registration on SDAIA's national data governance platform where required by the regulations.

Breach notification

Controllers must notify SDAIA of personal data breaches that may harm data subjects' rights or interests within 72 hours of becoming aware, with details of the incident, data affected, likely consequences and measures taken. Affected data subjects must be informed without undue delay where the breach may cause harm, with advice on protective steps. Processors must notify controllers promptly. Organisations should keep a record of breaches and actions taken.

Cross-border transfers

Transfers of personal data outside the Kingdom are allowed for specified purposes, such as performing obligations under agreements to which the Kingdom is party, serving the Kingdom's interests, performing contracts with the data subject, or other purposes set in the regulations, provided they do not prejudice national security or vital interests and that adequate protection is ensured. The Transfer Regulations allow transfers to countries with adequate protection as determined by SDAIA, or under appropriate safeguards such as standard contractual clauses, binding common rules and certification, and provide limited exceptions. Transfers of sensitive data and large-scale transfers may require a risk assessment. Reports in 2026 indicated that SDAIA had not yet published a final adequacy list, so most transfers rely on safeguards. Sector rules, such as those for government, financial and health data, may impose data localisation.

Processors and technology vendors

Most SaaS and IT vendors act as processors for Saudi clients. Controllers must choose processors that provide sufficient guarantees and bind them with contracts specifying processing instructions, security measures, confidentiality, subprocessing, assistance with data subject requests and breaches, and return or deletion of data. Processors must follow instructions, implement security, keep records where required, and notify controllers of breaches promptly so they can meet the 72-hour deadline. Vendors that access data from outside the Kingdom, for example for support or development, create transfers that must meet the Transfer Regulations, so contracts and technical controls should address this explicitly.

Marketing and communications

Direct marketing using personal data generally requires the data subject's consent and an easy way to opt out. Organisations should record consent, honour opt-outs promptly and avoid sending marketing to people who have not agreed. Telecommunications and consumer protection rules may add requirements for SMS and calls. For e-commerce and app businesses, this means separating transactional messages from marketing and managing consent preferences carefully.

Sector rules and localisation

The PDPL sits alongside sector requirements. Government entities follow national data management and classification policies that often require data to stay in the Kingdom. Financial institutions follow Saudi Central Bank rules, health providers follow health data rules, and critical sectors follow National Cybersecurity Authority controls, including cloud cybersecurity controls. These can restrict where data is hosted and who can access it, so vendors should confirm sector requirements with each client before designing hosting and support arrangements.

Penalties and enforcement

Violations can result in warnings and fines of up to SAR 5 million per violation, which can be doubled for repeat violations. Disclosing or publishing sensitive data unlawfully with intent to harm or for personal benefit can lead to imprisonment of up to two years and fines of up to SAR 3 million. Courts can order confiscation of funds obtained from violations, and SDAIA can require publication of penalties. SDAIA announced 48 enforcement decisions by mid-January 2026 across sectors, covering issues such as processing without authorisation, incomplete records and failures to respond within deadlines.

2026 draft amendments

On 6 October 2026, SDAIA opened a public consultation, running to 5 November 2026, on proposed amendments to the PDPL Implementing Regulations. Commentators describe the proposals as extensive, aiming to clarify procedures and controls and strengthen enforcement. Earlier consultations in 2025 also proposed clarifications. Organisations should comply with current rules while monitoring the final text.

Topic	Saudi PDPL	GDPR
Main legal basis	Consent, with defined alternatives including legitimate interest	Six equal legal bases
Breach notification	72 hours to SDAIA	72 hours to the supervisory authority
Transfers	Permitted purposes plus adequacy or safeguards, with risk assessments	Adequacy, safeguards or derogations
Regulator	Single national authority (SDAIA)	National authorities with EU cooperation
Maximum fine	SAR 5 million, doubled for repeats, plus criminal penalties	EUR 20 million or 4% of worldwide turnover

How to comply, step by step

Confirm scope: processing in the Kingdom or of residents' data.
Map personal data, sensitive data, purposes, legal bases and transfers.
Publish an Arabic and English privacy notice.
Implement consent management and legitimate interest assessments.
Set up data subject request handling within 30 days.
Keep records of processing and run impact assessments for high-risk processing.
Appoint a DPO and register on SDAIA's platform where required.
Prepare 72-hour breach notification procedures.
Put transfer safeguards in place and assess transfer risks.
Bind processors by contract.

Data subject requests in practice

Organisations should give individuals simple ways to exercise their rights, such as an online form, email address or in-app option, verify identity proportionately, log each request, and respond within the regulatory timeframe. Where a request cannot be fulfilled, for example because data must be retained by law, the response should explain why. Building self-service access, correction and deletion into account settings reduces manual effort and helps meet deadlines consistently.

Documentation you will need

Records of processing activities.
Privacy notices and consent records.
Legitimate interest and impact assessments.
Data subject request logs.
Breach register and notifications.
Transfer assessments and contractual safeguards.
Processor contracts.
DPO appointment and platform registration where applicable.

Timeline and cost considerations

Organisations already aligned with the GDPR can usually adapt to the PDPL in one to three months, mainly by adding Saudi legal basis analysis, Arabic notices, transfer assessments, the SDAIA breach process and any registration or DPO requirements. Starting from scratch takes longer. Costs include legal review, translation, hosting changes where localisation applies, and tooling for consent and requests. With enforcement now active, closing gaps quickly is more important than waiting for the amended regulations.

Children and special categories

Processing personal data of people who lack full legal capacity, including children, requires consent from their legal guardian and additional care. Sensitive data, such as health, biometric and credit data, requires stronger security, stricter purpose limits and, in many cases, impact assessments. Credit data has specific rules on consent and disclosure. Products serving families, students or patients in the Kingdom should design consent and data handling with these categories in mind from the start.

Common mistakes

Assuming a GDPR policy is enough without Saudi-specific bases, language and transfer rules.
No Arabic notice for Saudi users.
Using legitimate interest for sensitive data.
Unassessed transfers to offshore support or development teams.
Missing the 72-hour breach window.
Ignoring sector localisation rules for government, health or financial data.

Best practices, tools and technologies

Host Saudi customer data in in-Kingdom cloud regions where clients or sectors require it.
Restrict and log remote access from outside the Kingdom.
Use consent management with Arabic interfaces.
Automate data subject requests and retention.
Align security with Saudi National Cybersecurity Authority controls for regulated clients.
Structure privacy controls with ISO/IEC 27701.

We build privacy notices, consent records, data subject request workflows and region-aware hosting into platforms through our web application development and SaaS product services.

How it relates to other laws

Law	Relationship
GDPR	Similar principles and rights; the PDPL relies more on consent and has stricter transfer controls.
UAE PDPL	Neighbouring federal law with its own regulator and free zone exceptions.
India DPDP Act	Relevant for Indian vendors processing Saudi data offshore.
NCA controls	Saudi National Cybersecurity Authority controls for government and critical sectors.

Real-world example

An Indian SaaS company provides HR software to Saudi employers. It hosts Saudi customer data in an in-Kingdom cloud region, publishes Arabic and English privacy notices, signs processor agreements with customers, limits support access from India to masked data through logged sessions, documents a transfer risk assessment with contractual safeguards for that access, keeps records of processing, and runs a 72-hour breach procedure aligned with customers' obligations to notify SDAIA.

Next steps

Confirm PDPL scope.
Map data and transfers.
Publish notices and set up rights handling.
Prepare breach and transfer processes.
Track the 2026 amendments.

Frequently asked questions

When did the Saudi PDPL take effect?

On 14 September 2023, with full enforcement from 14 September 2024.

Does the PDPL apply to foreign companies?

Yes, when they process personal data of residents of Saudi Arabia.

Who enforces the PDPL?

The Saudi Data and Artificial Intelligence Authority (SDAIA), through its data management office, with courts handling criminal penalties.

What are the maximum fines?

Up to SAR 5 million per violation, doubled for repeat violations, with criminal penalties for unlawful disclosure of sensitive data.

How quickly must breaches be reported?

Within 72 hours to SDAIA when a breach may harm data subjects.

Can personal data be transferred outside Saudi Arabia?

Yes, for permitted purposes with adequate protection or appropriate safeguards, subject to the Transfer Regulations and sector rules.

Does the PDPL allow legitimate interest?

Yes, with an assessment and not for sensitive data.

Is a DPO required?

In specified cases, such as public entities and large-scale monitoring or sensitive data processing.

Is SDAIA enforcing the law?

Yes. SDAIA announced 48 enforcement decisions by January 2026.

Are the regulations changing?

SDAIA consulted on extensive amendments to the Implementing Regulations from October to November 2026.

Do privacy notices need to be in Arabic?

Notices should be clear and accessible to data subjects; for Saudi users, providing Arabic alongside English is expected in practice and recent consultations addressed language obligations.

Does the PDPL require data to stay in Saudi Arabia?

The PDPL allows transfers under conditions, but sector rules for government, financial, health and critical infrastructure data may require localisation.

What are a processor's duties under the PDPL?

Follow the controller's instructions, implement security measures, maintain confidentiality, assist with rights requests and notify the controller of breaches promptly.