Saudi Arabia Personal Data Protection Law (PDPL) Assessment

The PDPL applies to any processing of personal data that takes place in Saudi Arabia, by any means, and to organizations outside the Kingdom that process the personal data of individuals residing in it. It covers public and private entities and the data of deceased persons where it could identify them or a family member. Processing by an individual for purely personal or family use is excluded. Sector rules (for example SAMA, the Insurance Authority or CST) apply in addition to the PDPL.

A strong inventory captures what personal data you collect, where it comes from, where it is stored (cloud, SaaS, on-premises), how long it is retained, who can access it, and how it moves internally, to vendors and outside the Kingdom. Sensitive data under the PDPL includes health, genetic and biometric data, data relating to security, criminal convictions and offences, data revealing racial or ethnic origin or religious, intellectual or political beliefs, and data indicating that one or both of a person’s parents are unknown.

The PDPL makes consent the default basis and permits processing without consent only in defined cases: a clear benefit to the data subject where contact is impossible or impractical, another law or a prior agreement with the data subject, a public entity's security or judicial purposes, and the controller's legitimate interests (not available for sensitive data and subject to an assessment under the Implementing Regulations). Processing without a legal basis was among the violations penalized by SDAIA in 2025.

Under the PDPL and its Implementing Regulations, consent must be freely given, specific to the purpose, informed and evidenced. It cannot be a condition for a service or benefit unless directly related to the processing, and it can be withdrawn at any time, as easily as it was given. Explicit consent is required for sensitive personal data, credit data and decisions based solely on automated processing of Personal Data

The PDPL requires prior consent before using a data subject's personal communication channels for advertising or awareness material, together with a clear mechanism to stop receiving it. The Implementing Regulations allow a limited exception where the controller has had a prior interaction with the recipient.

The PDPL requires a privacy policy to be available to data subjects before collection, covering the purpose of collection, the content of the data collected, the collection method, the means of storage and processing, how the data will be destroyed, the data subject's rights and how to exercise them. When collecting directly from data subjects, controllers must also state the legal basis and purpose of the collection, whether providing the data is mandatory or optional, identify the entities to which the data may be disclosed, explain whether the data will be transferred, disclosed or processed outside the Kingdom, and describe the potential consequences or risks of not providing the data.

The PDPL grants Data Subjects the right to be informed, the right to access their Personal Data, the right to request a copy of their Personal Data in a readable and clear format, the right to request correction, completion or updating, and the right to request destruction where applicable. Separately, where processing is based on consent, the Data Subject may withdraw consent at any time under the PDPL.

Under the PDPL and its Implementing Regulations, Controllers must have appropriate mechanisms to receive and process Data Subject rights requests. The Controller must verify the requester’s identity, act on the request without delay and within 30 days, and may extend this period by up to a further 30 days where implementation requires disproportionate effort or where multiple requests are received, provided the Data Subject is notified in advance with the reasons for the delay. Controllers must document and keep records of submitted requests, including oral requests. When providing access or a copy of Personal Data, the Controller must ensure that it does not disclose Personal Data identifying another individual.

Registration on SDAIA’s National Data Governance Platform is mandatory for Controllers within the Kingdom where the Controller is a public entity, the Controller’s main activity is based on personal data processing, the Controller processes sensitive data, or an individual processes personal data for purposes beyond personal or family use. The registration certificate is valid for up to five years. SDAIA’s Rules for Appointing a Personal Data Protection Officer, issued in August 2024, require a DPO where the Controller is a public entity providing services involving large-scale personal data processing, where the Controller’s core activities require regular and systematic monitoring of Data Subjects, or where the Controller’s core activities are based on processing sensitive Personal Data. If appointed, the DPO’s details must be submitted through the National Data Governance Platform.

Controllers must keep a record of processing activities during processing and for five years after the relevant processing activity ends. These records should cover the Controller’s contact details, processing purposes, categories of Data Subjects, recipients or entities to which Personal Data is disclosed, transfers or disclosures outside the Kingdom, and retention periods. Personal Data must be limited to the minimum necessary for the processing purpose and destroyed without undue delay when it is no longer necessary, unless an Article 18 retention exception applies, such as a statutory retention requirement, judicial requirement, or removal of identifiers.

The PDPL requires Controllers to assess the impact of processing Personal Data for products or services provided to the public. The Implementing Regulations require a written and documented impact assessment for specified higher-risk processing activities, including processing Sensitive Data, continuous monitoring of Data Subjects, use of new technologies, decisions made solely based on automated processing of Personal Data, and certain continuous or large-scale processing activities. A documented legitimate-interest assessment is also required where the Controller relies on Legitimate Interest as the legal basis for processing.

The PDPL requires Controllers to protect Personal Data by implementing appropriate organizational, administrative and technical measures. The Implementing Regulations require these measures to take into account the nature and sensitivity of the Personal Data and the risks to Data Subjects’ privacy, as well as applicable controls, standards and requirements issued by the National Cybersecurity Authority and other competent authorities. Typical safeguards may include access controls, encryption, monitoring for misconfiguration or excessive access, staff training, confidentiality controls, vendor security requirements and incident/breach reporting procedures. Failure to implement appropriate safeguards may expose Controllers to PDPL enforcement action and penalties.

Controllers must notify SDAIA of a Personal Data breach within 72 hours of becoming aware of it where the breach may harm Personal Data or Data Subjects, or conflict with their rights or interests. Notification should be submitted through the mechanism specified by SDAIA, currently the National Data Governance Platform, and should describe the breach, affected data and individuals, likely consequences or risks, and measures taken or proposed. Affected Data Subjects must be informed without undue delay, in clear and simple language, where the breach may harm them or conflict with their rights or interests. Controllers should also document breach assessments, notifications, decisions and remedial actions.

Controllers must select Processors that provide sufficient guarantees to protect Personal Data and comply with the PDPL and its Implementing Regulations. Processor arrangements should be governed by a documented agreement setting out required terms, including the purpose of Processing, categories of Personal Data, duration of Processing, subcontractors or other disclosure recipients, foreign regulatory exposure, and the Processor’s obligation to notify the Controller of a Personal Data Breach without undue delay. Controllers must periodically assess Processor compliance and monitor any third parties acting on the Processor’s behalf. When entering into a Processor agreement, Controllers must also verify whether the Processor has a DPO and, where required under SDAIA’s DPO Rules, request that one be appointed.

Transfers outside the Kingdom are permitted under Article 29 of the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom (September 2024) to destinations SDAIA assesses as adequate or, in the absence of an adequacy finding, under appropriate safeguards: SDAIA's Standard Contractual Clauses, Binding Common Rules or a certificate of accreditation. A risk assessment is required where safeguards are relied on and where sensitive data is transferred on a continuous or large-scale basis. SDAIA had not published an adequacy list as of September 2026.