⁦Saudi PDPL⁩

⁦Saudi Arabia⁩ پرائیویسی

حیثیت

⁦In force since 14 September 2023; SDAIA⁩'⁦s one-year grace period ended 14 September 2024 and the law has been fully enforced since (some entities may have been given longer). SDAIA reported 48 enforcement decisions by mid-January 2026.⁩✓⁦PDPL (Royal Decree M/19 of 9/2/1443H, amended by M/148 of 5/9/1444H); SDAIA Guide to the PDPL (Dec 2023) ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦dlapiperdataprotection.com⁩, ⁦clydeco.com⁩, ⁦clydeco.com⁩

یہ کن پر لاگو ہوتا ہے

⁦Any processing of personal data in the Kingdom, and processing by parties outside the Kingdom of personal data of individuals residing in Saudi Arabia, whatever their nationality (Art. 2(1)). Purely personal or family use is excluded if the data is not published or disclosed to others (Art. 2(2)).⁩✓⁦PDPL Art. 2 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦dlapiperdataprotection.com⁩

سائز کی حدیں

⁦No turnover or headcount threshold; the only carve-out is personal or family use (Art. 2(2)). Extra duties depend on the processing: registration (public entities, controllers whose main activity is processing personal data, sensitive-data processors) and a DPO (large-scale or sensitive processing).⁩✓⁦PDPL Art. 2; National Register Rules Art. 2; Implementing Regulation Art. 32 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦dgp.sdaia.gov.sa⁩, ⁦dlapiperdataprotection.com⁩

ریگولیٹر

⁦The Saudi Data⁩ & ⁦AI Authority (SDAIA) is the Competent Authority. Specialised Committees for Reviewing Violations hear most cases. The Saudi Central Bank and CST keep data-protection powers within their own sectors.⁩✓⁦PDPL (Competent Authority); Implementing Regulation ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦dlapiperdataprotection.com⁩, ⁦clydeco.com⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦Notify SDAIA through the National Data Governance Platform within 72 hours of becoming aware of a breach that may harm personal data or data subjects, or conflict with their rights or interests (Implementing Regulation Art. 24). Also notify affected data subjects where the breach may damage their data or conflict with their rights or interests (PDPL Art. 20(2)).⁩✓⁦PDPL Art. 20; Implementing Regulation Art. 24 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦misa.gov.sa⁩, ⁦akingump.com⁩, ⁦dlapiperdataprotection.com⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦Respond within 30 days of the request. The controller may extend by a further 30 days where the request needs unexpected or unusual extra effort, or the same data subject makes multiple requests (Implementing Regulation).⁩⁦PDPL Art. 21 (period set by the Regulations); Implementing Regulation (article not verified) ·⁩ ذرائع: ⁦misa.gov.sa⁩, ⁦akingump.com⁩

ڈیٹا پروٹیکشن آفیسر

⁦A DPO is mandatory for (1) a public entity providing services that involve large-scale processing, (2) controllers whose core activities require regular and systematic monitoring of data subjects, and (3) controllers whose core activities involve sensitive data (Implementing Regulation Art. 32; DPO Rules Art. 5). The DPO may be an employee or an external contractor, appointed in writing, with contact details given to SDAIA via the Platform.⁩⁦PDPL Art. 30; Implementing Regulation Art. 32; DPO Rules Art. 5 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦cms.law⁩, ⁦dlapiperdataprotection.com⁩, ⁦akingump.com⁩

مقامی نمائندہ

⁦Neither the PDPL nor its Implementing Regulation imposes a general duty on foreign controllers to appoint a representative in Saudi Arabia. The⁩ '⁦representative⁩' ⁦in the National Register Rules is just the natural person a controller designates to complete Platform registration (Art. 1(5), Art. 3). Those Rules cover controllers within the Kingdom; SDAIA said separate registration rules for controllers outside the Kingdom would follow.⁩✓⁦National Register Rules (Introduction, Arts. 1(5), 3); Implementing Regulation ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦twobirds.com⁩, ⁦lw.com⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Transfers are allowed only for permitted purposes (PDPL Art. 29), limited to the minimum data needed, and must not prejudice national security or vital interests. They may go to countries on SDAIA⁩'⁦s adequacy list (Transfer Reg. Art. 3), or else under appropriate safeguards: SDAIA standard contractual clauses, binding common rules, or a certificate of accreditation (Art. 4(1)). Limited exemptions cover public bodies, one-off/limited transfers, intra-group central operations, services to the data subject and research (Art. 4(2)). A risk assessment is required before transfers relying on an exemption and for continuous or widespread transfers of sensitive data (Art. 7).⁩✓⁦PDPL Art. 29; Regulation on Personal Data Transfer outside the Kingdom v2.0 (Aug 2024) Arts. 2-7 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦spa.gov.sa⁩, ⁦lw.com⁩, ⁦dlapiperdataprotection.com⁩

کوکیز اور رضامندی

⁦Consent is the main legal basis, with other bases available, and it can be withdrawn at any time (PDPL Arts. 5-6). Legitimate interest cannot be used for sensitive data (Art. 6(4)), and consent to process sensitive data must be explicit (IR Art. 11). Direct marketing needs consent with an easy opt-out, and sensitive data cannot be used for marketing (IR Arts. 26 and 28). There is no specific cookie law.⁩✓⁦PDPL Arts. 5-6, 25; Implementing Regulation Arts. 11, 26, 28 ·⁩ ذرائع: ⁦dgp.sdaia.gov.sa⁩, ⁦clydeco.com⁩, ⁦dlapiperdataprotection.com⁩

زیادہ سے زیادہ سزا

⁦Administrative fines of up to SAR 5 million, or a warning, imposed by a Violations Committee, with appeal to the competent court; the fine can be doubled for repeat violations, up to twice the cap (PDPL Art. 36). Disclosing or publishing sensitive data with intent to harm the data subject or for personal benefit carries up to 2 years⁩' ⁦imprisonment and/or a fine of up to SAR 3 million, which can also be doubled for repeat offences (Art. 35). Courts may order confiscation of proceeds, the court or committee may order the decision published at the violator⁩'⁦s expense (Art. 38), and individuals can claim compensation (Art. 40).⁩✓⁦PDPL Arts. 35, 36, 38, 40 ·⁩ ذرائع: ⁦misa.gov.sa⁩, ⁦dlapiperdataprotection.com⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦Register on SDAIA⁩'⁦s National Data Governance Platform if you are a public entity, process sensitive data, or have personal-data processing as your main activity (Register Rules Art. 2).⁩
• ⁦Check whether you must appoint a DPO and appoint one if so (PDPL Art. 30; IR Art. 32).⁩
• ⁦Have a lawful basis (usually consent), publish a privacy policy, and keep records of processing (PDPL Arts. 5-6, 12, 31).⁩
• ⁦Report harmful breaches to SDAIA within 72 hours and notify affected individuals who could be harmed (IR Art. 24; PDPL Art. 20).⁩
• ⁦Transfer data abroad only to adequate countries or under SDAIA SCCs, binding common rules or certification, and run a risk assessment where required (Transfer Reg. Arts. 3-7).⁩

حالیہ تبدیلیاں

⁦1 Sept 2024: SDAIA issued the amended Transfer Regulation (v2.0) together with SCCs, the DPO Rules and the National Register Rules; full enforcement began 14 Sept 2024. 27 Apr-27 May 2025: SDAIA consulted on draft amendments to the Implementing Regulation (DPO duties, records of processing, registration for controllers transferring data abroad, a 10-business-day deadline to answer SDAIA, a 90-day complaint window); no final outcome confirmed. 8 Oct 2026: SPA listed SDAIA⁩'⁦s⁩ '⁦Amendments to the Implementing Regulations of the PDPL⁩' ⁦among projects open on Istitlaa, with feedback until 5 Nov 2026. The contents of the 2026 draft were not verified. Drafts are NOT law.⁩

ذرائع

• بنیادی ذریعہ: ⁦https://dgp.sdaia.gov.sa/wps/portal/pdp/home⁩
• دوسرا ذریعہ: ⁦https://www.dlapiperdataprotection.com/index.html?t=law⁩&⁦c=SA⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.