Home › Compare laws side by side › Saudi PDPL vs EU GDPR
Saudi PDPL vs EU GDPR
Personal Data Protection Law (Royal Decree No. M/19 of 1443H, amended by Royal Decree No. M/148 of 1444H) (Saudi Arabia) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | Saudi PDPL Saudi Arabia 11/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force since 14 September 2023; SDAIA's one-year grace period ended 14 September 2024 and the law has been fully enforced since (some entities may have been given longer). SDAIA reported 48 enforcement decisions by mid-January 2026.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Any processing of personal data in the Kingdom, and processing by parties outside the Kingdom of personal data of individuals residing in Saudi Arabia, whatever their nationality (Art. 2(1)). Purely personal or family use is excluded if the data is not published or disclosed to others (Art. 2(2)).✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No turnover or headcount threshold; the only carve-out is personal or family use (Art. 2(2)). Extra duties depend on the processing: registration (public entities, controllers whose main activity is processing personal data, sensitive-data processors) and a DPO (large-scale or sensitive processing).✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | The Saudi Data & AI Authority (SDAIA) is the Competent Authority. Specialised Committees for Reviewing Violations hear most cases. The Saudi Central Bank and CST keep data-protection powers within their own sectors.✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Notify SDAIA through the National Data Governance Platform within 72 hours of becoming aware of a breach that may harm personal data or data subjects, or conflict with their rights or interests (Implementing Regulation Art. 24). Also notify affected data subjects where the breach may damage their data or conflict with their rights or interests (PDPL Art. 20(2)).✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | Respond within 30 days of the request. The controller may extend by a further 30 days where the request needs unexpected or unusual extra effort, or the same data subject makes multiple requests (Implementing Regulation). | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | A DPO is mandatory for (1) a public entity providing services that involve large-scale processing, (2) controllers whose core activities require regular and systematic monitoring of data subjects, and (3) controllers whose core activities involve sensitive data (Implementing Regulation Art. 32; DPO Rules Art. 5). The DPO may be an employee or an external contractor, appointed in writing, with contact details given to SDAIA via the Platform. | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | Neither the PDPL nor its Implementing Regulation imposes a general duty on foreign controllers to appoint a representative in Saudi Arabia. The 'representative' in the National Register Rules is just the natural person a controller designates to complete Platform registration (Art. 1(5), Art. 3). Those Rules cover controllers within the Kingdom; SDAIA said separate registration rules for controllers outside the Kingdom would follow.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Transfers are allowed only for permitted purposes (PDPL Art. 29), limited to the minimum data needed, and must not prejudice national security or vital interests. They may go to countries on SDAIA's adequacy list (Transfer Reg. Art. 3), or else under appropriate safeguards: SDAIA standard contractual clauses, binding common rules, or a certificate of accreditation (Art. 4(1)). Limited exemptions cover public bodies, one-off/limited transfers, intra-group central operations, services to the data subject and research (Art. 4(2)). A risk assessment is required before transfers relying on an exemption and for continuous or widespread transfers of sensitive data (Art. 7).✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Consent is the main legal basis, with other bases available, and it can be withdrawn at any time (PDPL Arts. 5-6). Legitimate interest cannot be used for sensitive data (Art. 6(4)), and consent to process sensitive data must be explicit (IR Art. 11). Direct marketing needs consent with an easy opt-out, and sensitive data cannot be used for marketing (IR Arts. 26 and 28). There is no specific cookie law.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Administrative fines of up to SAR 5 million, or a warning, imposed by a Violations Committee, with appeal to the competent court; the fine can be doubled for repeat violations, up to twice the cap (PDPL Art. 36). Disclosing or publishing sensitive data with intent to harm the data subject or for personal benefit carries up to 2 years' imprisonment and/or a fine of up to SAR 3 million, which can also be doubled for repeat offences (Art. 35). Courts may order confiscation of proceeds, the court or committee may order the decision published at the violator's expense (Art. 38), and individuals can claim compensation (Art. 40).✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- Saudi PDPL
- Any processing of personal data in the Kingdom, and processing by parties outside the Kingdom of personal data of individuals residing in Saudi Arabia, whatever their nationality (Art. 2(1)). Purely personal or family use is excluded if the data is not published or disclosed to others (Art. 2(2)).
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under Saudi PDPL
- Register on SDAIA's National Data Governance Platform if you are a public entity, process sensitive data, or have personal-data processing as your main activity (Register Rules Art. 2).
- Check whether you must appoint a DPO and appoint one if so (PDPL Art. 30; IR Art. 32).
- Have a lawful basis (usually consent), publish a privacy policy, and keep records of processing (PDPL Arts. 5-6, 12, 31).
- Report harmful breaches to SDAIA within 72 hours and notify affected individuals who could be harmed (IR Art. 24; PDPL Art. 20).
- Transfer data abroad only to adequate countries or under SDAIA SCCs, binding common rules or certification, and run a risk assessment where required (Transfer Reg. Arts. 3-7).
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@