PDPL Saudi Arabia: The Complete Guide
Saudi Arabia's Personal Data Protection Law is the Kingdom's first comprehensive data protection legislation and a key component of the country's Vision 2030 digital transformation strategy. Issued by Royal Decree in September 2021 and amended in 2023, the PDPL is administered by the Saudi Data and Artificial Intelligence Authority (SDAIA), with full enforcement beginning September 14, 2024.
What the PDPL Covers
The PDPL establishes consent as the primary basis for processing personal data, with specific exceptions for legal obligations, contractual performance, public interest, vital interests, and publicly available data. Consent must be explicit, informed, and freely given, and data subjects may withdraw consent at any time.
Sensitive personal data — including health data, genetic and biometric information, ethnicity, religious and intellectual beliefs, criminal records, and financial data — is subject to heightened protections. Processing sensitive data generally requires explicit consent and additional safeguards.
Data subjects receive comprehensive rights including the right to be informed, access their data, request correction, request destruction of data no longer needed, and data portability. Controllers must respond to requests and provide mechanisms for exercising these rights.
Cross-Border Transfers
The PDPL restricts the transfer of personal data outside Saudi Arabia. Transfers are permitted to countries or organizations that provide adequate protection as determined by SDAIA, or where the transfer is necessary for contractual or legal purposes and adequate safeguards are implemented. Data localization may be required for certain categories of data.
Who Needs to Comply
The PDPL applies to all organizations that process personal data within Saudi Arabia, as well as organizations outside the Kingdom that process personal data of individuals residing in Saudi Arabia. Both public and private sector entities are covered.
Enforcement and Penalties
SDAIA has the authority to investigate violations and impose penalties. Fines can reach up to 5 million Saudi Riyals (approximately $1.3 million) per violation. Criminal penalties apply for certain offenses including unauthorized disclosure of sensitive data, with imprisonment of up to two years.
Practical Compliance Steps
- Consent management — Implement explicit consent mechanisms for all personal data processing
- Data inventory — Map all personal and sensitive data processing activities
- Rights fulfillment — Build processes for access, correction, deletion, and portability requests
- Cross-border assessment — Evaluate transfer destinations and implement required safeguards
- Breach notification — Establish procedures for SDAIA notification following a data breach
- Record keeping — Maintain records of processing activities, consent, and data transfers