Saudi PDPL

Saudi Arabia Privacy

Status

In force since 14 September 2023; SDAIA's one-year grace period ended 14 September 2024 and the law has been fully enforced since (some entities may have been given longer). SDAIA reported 48 enforcement decisions by mid-January 2026.✓PDPL (Royal Decree M/19 of 9/2/1443H, amended by M/148 of 5/9/1444H); SDAIA Guide to the PDPL (Dec 2023) · Sources: dgp.sdaia.gov.sa, dlapiperdataprotection.com, clydeco.com, clydeco.com

Who it applies to

Any processing of personal data in the Kingdom, and processing by parties outside the Kingdom of personal data of individuals residing in Saudi Arabia, whatever their nationality (Art. 2(1)). Purely personal or family use is excluded if the data is not published or disclosed to others (Art. 2(2)).✓PDPL Art. 2 · Sources: dgp.sdaia.gov.sa, dlapiperdataprotection.com

Size thresholds

No turnover or headcount threshold; the only carve-out is personal or family use (Art. 2(2)). Extra duties depend on the processing: registration (public entities, controllers whose main activity is processing personal data, sensitive-data processors) and a DPO (large-scale or sensitive processing).✓PDPL Art. 2; National Register Rules Art. 2; Implementing Regulation Art. 32 · Sources: dgp.sdaia.gov.sa, dgp.sdaia.gov.sa, dlapiperdataprotection.com

Regulator

The Saudi Data & AI Authority (SDAIA) is the Competent Authority. Specialised Committees for Reviewing Violations hear most cases. The Saudi Central Bank and CST keep data-protection powers within their own sectors.✓PDPL (Competent Authority); Implementing Regulation · Sources: dgp.sdaia.gov.sa, dlapiperdataprotection.com, clydeco.com

Breach or incident reporting

Notify SDAIA through the National Data Governance Platform within 72 hours of becoming aware of a breach that may harm personal data or data subjects, or conflict with their rights or interests (Implementing Regulation Art. 24). Also notify affected data subjects where the breach may damage their data or conflict with their rights or interests (PDPL Art. 20(2)).✓PDPL Art. 20; Implementing Regulation Art. 24 · Sources: dgp.sdaia.gov.sa, misa.gov.sa, akingump.com, dlapiperdataprotection.com

Deadline to answer personal data requests

Respond within 30 days of the request. The controller may extend by a further 30 days where the request needs unexpected or unusual extra effort, or the same data subject makes multiple requests (Implementing Regulation).PDPL Art. 21 (period set by the Regulations); Implementing Regulation (article not verified) · Sources: misa.gov.sa, akingump.com

Data protection officer

A DPO is mandatory for (1) a public entity providing services that involve large-scale processing, (2) controllers whose core activities require regular and systematic monitoring of data subjects, and (3) controllers whose core activities involve sensitive data (Implementing Regulation Art. 32; DPO Rules Art. 5). The DPO may be an employee or an external contractor, appointed in writing, with contact details given to SDAIA via the Platform.PDPL Art. 30; Implementing Regulation Art. 32; DPO Rules Art. 5 · Sources: dgp.sdaia.gov.sa, cms.law, dlapiperdataprotection.com, akingump.com

Local representative

Neither the PDPL nor its Implementing Regulation imposes a general duty on foreign controllers to appoint a representative in Saudi Arabia. The 'representative' in the National Register Rules is just the natural person a controller designates to complete Platform registration (Art. 1(5), Art. 3). Those Rules cover controllers within the Kingdom; SDAIA said separate registration rules for controllers outside the Kingdom would follow.✓National Register Rules (Introduction, Arts. 1(5), 3); Implementing Regulation · Sources: dgp.sdaia.gov.sa, twobirds.com, lw.com

Sending data abroad

Transfers are allowed only for permitted purposes (PDPL Art. 29), limited to the minimum data needed, and must not prejudice national security or vital interests. They may go to countries on SDAIA's adequacy list (Transfer Reg. Art. 3), or else under appropriate safeguards: SDAIA standard contractual clauses, binding common rules, or a certificate of accreditation (Art. 4(1)). Limited exemptions cover public bodies, one-off/limited transfers, intra-group central operations, services to the data subject and research (Art. 4(2)). A risk assessment is required before transfers relying on an exemption and for continuous or widespread transfers of sensitive data (Art. 7).✓PDPL Art. 29; Regulation on Personal Data Transfer outside the Kingdom v2.0 (Aug 2024) Arts. 2-7 · Sources: dgp.sdaia.gov.sa, spa.gov.sa, lw.com, dlapiperdataprotection.com

Cookies and consent

Consent is the main legal basis, with other bases available, and it can be withdrawn at any time (PDPL Arts. 5-6). Legitimate interest cannot be used for sensitive data (Art. 6(4)), and consent to process sensitive data must be explicit (IR Art. 11). Direct marketing needs consent with an easy opt-out, and sensitive data cannot be used for marketing (IR Arts. 26 and 28). There is no specific cookie law.✓PDPL Arts. 5-6, 25; Implementing Regulation Arts. 11, 26, 28 · Sources: dgp.sdaia.gov.sa, clydeco.com, dlapiperdataprotection.com

Maximum penalty

Administrative fines of up to SAR 5 million, or a warning, imposed by a Violations Committee, with appeal to the competent court; the fine can be doubled for repeat violations, up to twice the cap (PDPL Art. 36). Disclosing or publishing sensitive data with intent to harm the data subject or for personal benefit carries up to 2 years' imprisonment and/or a fine of up to SAR 3 million, which can also be doubled for repeat offences (Art. 35). Courts may order confiscation of proceeds, the court or committee may order the decision published at the violator's expense (Art. 38), and individuals can claim compensation (Art. 40).✓PDPL Arts. 35, 36, 38, 40 · Sources: misa.gov.sa, dlapiperdataprotection.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Register on SDAIA's National Data Governance Platform if you are a public entity, process sensitive data, or have personal-data processing as your main activity (Register Rules Art. 2).
• Check whether you must appoint a DPO and appoint one if so (PDPL Art. 30; IR Art. 32).
• Have a lawful basis (usually consent), publish a privacy policy, and keep records of processing (PDPL Arts. 5-6, 12, 31).
• Report harmful breaches to SDAIA within 72 hours and notify affected individuals who could be harmed (IR Art. 24; PDPL Art. 20).
• Transfer data abroad only to adequate countries or under SDAIA SCCs, binding common rules or certification, and run a risk assessment where required (Transfer Reg. Arts. 3-7).

Recent changes

1 Sept 2024: SDAIA issued the amended Transfer Regulation (v2.0) together with SCCs, the DPO Rules and the National Register Rules; full enforcement began 14 Sept 2024. 27 Apr-27 May 2025: SDAIA consulted on draft amendments to the Implementing Regulation (DPO duties, records of processing, registration for controllers transferring data abroad, a 10-business-day deadline to answer SDAIA, a 90-day complaint window); no final outcome confirmed. 8 Oct 2026: SPA listed SDAIA's 'Amendments to the Implementing Regulations of the PDPL' among projects open on Istitlaa, with feedback until 5 Nov 2026. The contents of the 2026 draft were not verified. Drafts are NOT law.

Sources

• Primary source: https://dgp.sdaia.gov.sa/wps/portal/pdp/home
• Second source: https://www.dlapiperdataprotection.com/index.html?t=law&c=SA

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.