Saudi PDPL

What is the Saudi PDPL?

The Personal Data Protection Law (PDPL) is Saudi Arabia’s first comprehensive data protection law. It was amended before entering into force and is supported by Implementing Regulations and Regulations on Personal Data Transfer outside the Kingdom. Together they set rules close in spirit to the GDPR, with notable local differences.

Who does it apply to?

Any processing of personal data relating to individuals in Saudi Arabia, including by organisations outside the Kingdom. Purely personal or family use is excluded.

Key duties

• Lawful processing: consent is the main basis, alongside other conditions such as legal obligation, contract and legitimate interest (with limits, especially for sensitive data).
• Transparency: a clear privacy notice that states purposes, legal basis and rights.
• Data subject rights: to be informed, to access, to obtain a copy, to correct, and to request destruction.
• Records and DPO: keep records of processing activities, and appoint a personal data protection officer in specified cases.
• Security and breaches: apply appropriate technical and organisational measures, and notify SDAIA within 72 hours of becoming aware of a breach that may harm individuals. Notify affected individuals where needed.
• Impact assessments: carry them out for higher-risk processing.
• Transfers abroad: permitted only under the Transfer Regulations, through adequacy, appropriate safeguards such as standard contractual clauses or binding common rules, or specific exceptions.
• Registration: certain controllers must register on SDAIA’s national data governance platform.

Enforcement

Violations can lead to warnings, fines of up to SAR 5 million (doubled for repeat violations) and, for disclosure of sensitive data with intent to harm, criminal penalties.

How does it relate to other frameworks?

Organisations in Saudi Arabia often also fall under the NCA’s Essential Cybersecurity Controls, which cover the security side.