Understanding Saudi Arabia’s Personal Data Protection Law (PDPL)

The Kingdom of Saudi Arabia's first comprehensive data protection law, the Personal Data Protection Law (PDPL), has been in force since 14 September 2023 and fully enforceable since 14 September 2024. The PDPL aims to protect individuals' personal data privacy and regulate organizations' collection, processing, disclosure, or retention of personal data. The Saudi Data & Artificial Intelligence Authority (SDAIA) is the competent authority that regulates and enforces the PDPL, and its violation-review committees began imposing penalties on non-compliant controllers in 2025.

The PDPL provides comprehensive requirements related to processing principles, data subjects' rights, organizations' obligations while processing the personal data of individuals, and cross-border data transfer mechanisms, and lays out penalties for organizations in case of non-compliance with the PDPL.

The PDPL was issued by Royal Decree No. M/19 dated 9/2/1443H (16 September 2021) and was originally due to take effect on 23 March 2022. SDAIA postponed the effective date to 17 March 2023 and, from 20 November to 20 December 2022, held a public consultation on proposed amendments to the PDPL. On 21 March 2023, the Saudi Council of Ministers approved the amendments, and the amended PDPL was issued by Royal Decree No. M/148 dated 5/9/1444H (27 March 2023).

On 7 September 2023, SDAIA published the Implementing Regulations to the PDPL and the Personal Data Transfer Regulations. The Implementing Regulations and the Regulations on Personal Data Transfers provide details on the general obligations and principles highlighted in the PDPL. The PDPL and its regulations came into force on 14 September 2023, followed by a one-year grace period for organizations to bring their practices into line. That grace period ended on 14 September 2024, and the PDPL and its regulations have been fully enforceable since then.

Around the end of the grace period, in August and September 2024, SDAIA issued a package of supplementary rules and guidance, including:

• The Rules for Appointing Personal Data Protection Officer (27 August 2024);
• The revised Regulation on Personal Data Transfer Outside the Kingdom (1 September 2024), which replaced the Personal Data Transfer Regulations published on 7 September 2023;
• The Rules Governing the National Register of Controllers Within the Kingdom (1 September 2024);
• SDAIA's Standard Contractual Clauses and Guidelines for Binding Common Rules (BCR) for cross-border transfers (1 September 2024), followed by the Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom in February 2025.

In April and May 2025, SDAIA held a public consultation on proposed amendments to the Implementing Regulations, covering privacy-policy language, direct marketing, record-keeping, complaint procedures, the role of the DPO and controller registration. At the time of writing, the final amended text has not been published; this page will be updated when it is.

Enforcement is now active. In January 2026, SDAIA announced that its Committees for Reviewing Violations of the PDPL had issued 48 decisions during 2025 confirming violations and imposing the prescribed penalties on controllers. The violations included collecting or processing personal data without a legal basis, disclosing personal data without legal justification, failing to implement appropriate organizational, administrative and technical safeguards, and sending advertising and marketing messages without data subjects' consent.

So, who needs to comply with the law? What rights do data subjects have? Who enforces it? To learn more about these questions plus a lot more to increase your compliance efforts, read on below:

1. Who Needs to Comply with PDPL

Here’s how the law applies to organizations based on their jurisdiction as well as the kind of data involved:

a. Material Scope

The PDPL applies to any processing of personal data, including sensitive personal data, that takes place in the Kingdom by any means, as well as to the processing of personal data of individuals residing in the Kingdom by entities located outside it. The PDPL also covers the deceased's personal data if it would lead to identifying the deceased or one of his/her family members specifically. The PDPL excludes the processing of personal data by an individual for personal or family purposes, provided the data is not published or disclosed to others.

b. Territorial Scope

The PDPL applies to public or private organizations that process personal data related to individuals in Saudi Arabia by any means. If a foreign organization processes personal data related to individuals residing in Saudi Arabia, then the PDPL also apply.

2. Obligations for Organizations Under PDPL

The PDPL imposes several obligations on controllers. The Implementing Regulations and the Personal Data Transfer Regulations have expanded upon these. Before processing personal data, controllers are required to ensure the personal data's accuracy, completeness, and relevancy. Controllers must also comply with the data protection principles (collection limitation, purpose limitation, data security, accountability, retention limitation, etc.). The one-year transition period that followed the PDPL's 14 September 2023 effective date ended on 14 September 2024; every obligation below is now fully enforceable.

Following are the critical obligations provided under the PDPL that organizations must meet to stay compliant:

a. Consent Requirements

The PDPL requires that organizations not process personal data without the consent of the data subject, except in the cases set out in the PDPL and its Implementing Regulations. Organizations must obtain consent that is given freely, and independent consent must be obtained for each purpose of processing. Explicit consent is required when processing sensitive personal data or credit data, and where decisions are based solely on automated processing of personal data.

Data subjects may withdraw their consent to the processing of personal data at any time, and consent must not be a prerequisite for the data controller to offer a service or benefit (unless the service or benefit is specifically related to the processing activity for which consent is obtained).

The PDPL provides that consent is not required in the following scenarios:

• If the processing would achieve a clear benefit for the data subject and it is impossible or impractical to contact the data subject;
• If it is required by another law or implements a prior agreement to which the data subject is a party;
• If the controller is a public entity and the processing is required for security purposes or to meet judicial requirements;
• If the data is processed for scientific, research, or statistical purposes in line with the safeguards set out in the law and the Implementing Regulations;
• If processing is necessary for the legitimate interests of the controller or another party, provided that the rights and interests of data subjects are not prejudiced. This basis was introduced by the 2023 amendments, is subject to the conditions in the Implementing Regulations, and does not apply to sensitive personal data.

b. Privacy Policy Requirements

The PDPL requires that organizations adopt a personal data privacy policy and make it available to data subjects to review before collecting their data. This policy shall include the purpose of its collection, the content of the personal data to be collected, the method of collecting it, the means of storing it, how it will be processed, how it will be destroyed, the rights of the data subject in relation to it, and how these rights can be exercised.

Organizations must – in the case of collecting personal data directly from data subjects – use adequate means to inform data subjects of the following elements before starting to collect their data:

• The valid legal or practical justification for collecting their personal data;
• The purpose of collecting their personal data, and whether collecting all or some of it is mandatory or optional, and informing them also that their data will not be processed later in a manner inconsistent with the purpose of its collection or in cases other than those stipulated in the PDPL;
• The identity of the person collecting the personal data and the address of their reference when necessary, unless the collection is for security purposes;
• The organization(s) to which the personal data will be disclosed, its/their capacity, and whether the personal data will be transferred, disclosed, or processed outside the Kingdom;
• Possible effects and dangers of not completing the personal data collection procedure;
• Data subject rights; and
• Any other elements specified in the Implementing Regulations according to the nature of the organization's activity.

c. Security Requirements

The PDPL requires organizations to take the necessary organizational, administrative, and technical measures and means to preserve personal data, including when it is transferred, per the provisions and controls specified by the Implementing Regulations and Personal Data Transfer Regulations, taking into account the controls issued by the National Cybersecurity Authority (NCA) and other competent authorities where applicable. Failure to implement appropriate safeguards was among the violations penalized by SDAIA's committees in 2025.

d. Data Breach Requirements

The PDPL and accompanying Regulations require that organizations notify SDAIA no later than 72 hours after first becoming aware of a data breach that may cause harm to the personal data or the data subject, or that conflicts with the data subject's rights or interests. Notifications are submitted through the National Data Governance Platform, following SDAIA's Personal Data Breach Incidents Procedural Guide. Furthermore, the data controller must provide SDAIA with a detailed analysis of the breach and what steps are being taken to ensure such an incident is not repeated.

Additionally, if the data breach may cause harm to data subjects or conflict with their rights or interests, the data controller must inform them without undue delay, in clear and simple language. The controller must also communicate the contact details of the relevant DPO the data subjects can contact to know more about the compromised data.

e. Data Protection Officer Requirement

To guarantee adherence to the Personal Data Protection Law, on 27 August 2024 SDAIA issued The Rules for Appointing Personal Data Protection Officer (DPO). A controller must appoint a DPO where:

• it is a public entity providing services that involve processing personal data on a large scale;
• its core activities involve regular and systematic monitoring of data subjects; or
• its core activities involve processing sensitive personal data.
• To determine if processing is occurring on a large scale, variables including the number of people impacted, the volume and type of data, the geographic scope, and the categories of data subjects involved, are taken into account.
• Regular and systematic monitoring includes activities like tracking via cookies, collecting health data through wearables, and using behavioral analytics technologies for risk assessments.

The DPO's primary duties include developing internal policies for data protection, assessing data breach response plans, training personnel, advising on data protection policies, and ensuring compliance with PDPL. Appointing a DPO is necessary when personal data is central to delivering services, not for internal tasks like HR managing employee data. This ensures compliance with data protection laws and safeguards individual privacy.

The Rules for Appointing a DPO provide the following guidance:

• The designated DPO must be academically qualified, have expertise in protecting personal data, and understand risk management procedures, which include dealing with data breaches.
• A DPO can be an executive, an external contractor, or an internal employee.
• DPO appointment and contact information must be documented, made available to the public, and submitted to SDAIA via the National Data Governance Platform.
• In order to enable the DPO to carry out their duties without interference, controllers should give them the tools, independence, and training they need.
• To keep their position inside the company, the DPO should be connected to the Data Management Office or a related division.

When organizations are engaging a data processor, they are required to evaluate whether the processor needs to appoint a DPO as per the SDAIA rules. If processors need to appoint a DPO, the controller must verify with processors whether a DPO has been assigned and, if not, make the necessary request.

SDAIA's proposed 2025 amendments to the Implementing Regulations would move the DPO framework into the Regulations themselves and spell out the DPO's duties more fully – acting as the liaison with SDAIA, handling data subject requests and complaints, notifying breaches, maintaining processing records and supervising DPIAs and audits. See our overview of the DPO Rules for more detail.

f. Data Protection Impact Assessment

The PDPL mandates organizations to conduct an assessment of the consequences of processing personal data for any product or service provided to the public according to the nature of their processing activities. The Implementing Regulations go further by specifying when an assessment is required and providing the minimum informational requirements for DPIAs.

g. Record of Processing Activities

Under the PDPL, organizations must keep records of their processing activities during the processing period and for an additional five years from the respective dates when the processing activities are completed. The records should include a minimum of the following data:

• Contact details of the organization;
• The purpose of processing personal data;
• A description of the categories of data subjects;
• Any party to which personal data has been (or will be) disclosed;
• Whether personal data has been (or will be) transferred outside Saudi Arabia or disclosed to a party outside Saudi Arabia; and
• The period of time that it is expected the personal data will be kept.

SDAIA's proposed 2025 amendments would remove this prescriptive minimum list while keeping the record-keeping duty itself; the list above reflects the Implementing Regulations currently in force.

h. Vendor Assessment/Third-Party Processing Requirements

The PDPL provides that organizations – when choosing the processing party – must choose an entity that provides the necessary guarantees for enforcing the provisions of the PDPL and must constantly verify such entity's compliance with its instructions in all matters relating to the protection of personal data. The Implementing Regulations also require a written agreement with the processor that sets out its obligations, including notifying the controller of any personal data breach without delay.

i. Cross Border Data Transfer Requirements

PDPL allows transfers outside of KSA but requires the recipient country to have regulations that ensure appropriate protection of personal data and a supervisory entity that imposes appropriate procedures and measures on controllers to protect personal data. Under the revised Regulation on Personal Data Transfer Outside the Kingdom (1 September 2024), SDAIA evaluates countries, international organizations and specific sectors against set criteria to determine whether they provide an adequate level of protection, subject to the exemptions described below. Article 29 of the PDPL outlines the conditions under which personal data can be transferred or disclosed outside the Kingdom:

• Purposes for Data Transfer or Disclosure: Personal data may be transferred outside the Kingdom to fulfill specific purposes, including:
• • Performing an obligation under an international agreement to which the Kingdom is a party.
  • Serving the interests of the Kingdom.
  • Fulfilling an obligation to which the data subject is a party.
  • Meeting other purposes outlined in the regulations.
• Conditions for Transfer or Disclosure: The law sets stringent conditions for such transfers to ensure data security and protection:
  • The transfer must not harm national security or the Kingdom's vital interests.
  • An adequate level of data protection must be in place outside the Kingdom, equivalent to the level guaranteed by domestic law. This must be verified by an assessment conducted by the SDAIA, in coordination with relevant authorities.
  • The amount of data transferred should be limited to the minimum necessary data required to achieve the intended purpose.
• Exceptions to Conditions: In emergencies, such as situations necessary to preserve the life or vital interests of the data subject or for the prevention, examination, or treatment of disease, the conditions outlined above may not apply.

Under Article 2 of the Revised Transfer Regulations, personal data may be transferred or disclosed to entities outside the Kingdom for additional purposes beyond those explicitly mentioned in Article 29 of the Law. These purposes include:

• Facilitating necessary operations for central data processing to enable the controller to efficiently manage its activities.
• Allowing for the provision of a service or benefit directly to the data subject.
• Supporting scientific research and studies, which may require access to personal data.

The SDAIA employs the following factors to assess a suitable degree of personal data protection, comparable to that ensured by the Kingdom

• The existence of regulations that protect personal data and the rights of data subjects, including compensation for damages from rights violations.
• A regulatory authority must be in place to enforce data protection laws.
• Willingness of the supervisory authority to cooperate with the Kingdom’s competent authority.
• Foreign regulations must not conflict with the Kingdom’s data protection laws or other applicable statutory provisions.
• Compliance with international treaties or agreements that mandate the transfer of personal data.
• Consideration of rules governing further transfers of personal data.

Maintaining a list of these adequate nations or organizations is the responsibility of SDAIA. The list is to be posted on SDAIA's official website and reviewed every four years or more frequently as needed. SDAIA reserves the right to amend the list if a country or organization no longer meets these standards, and may suspend data transfers to non-compliant entities as needed. The same standards apply to cities, special economic zones, and global trade centers. As of September 2026, SDAIA has not published an adequacy list, so in practice organizations transferring personal data outside the Kingdom rely on the appropriate safeguards and exemptions described below.

In circumstances where the adequate level of protection is absent and the exceptions provided under PDPL do not apply, organizations can transfer personal data abroad by implementing appropriate safeguards. These include:

• Standard Contractual Clauses: Pre-defined legal agreements ensuring data protection in compliance with PDPL. SDAIA published its SCCs on 1 September 2024 in four versions (controller-to-controller, controller-to-processor, processor-to-controller and processor-to-processor); they must be used without modification.
• Binding Common Rules: Internal rules within a group of multinational entities that align with the PDPL, prepared in line with SDAIA's BCR Guidelines (see our overview of the BCR Guidelines).
• Certificate of Accreditation: Approval from a licensed entity, confirming adherence to data protection standards under PDPL.

Appropriate safeguards must ensure compliance with the PDPL, protect data subjects' rights, including the right to file a complaint with SDAIA and allow them to seek compensation for any violations of the rights prescribed under PDPL.

Transfer of data outside the kingdom shall be subject to appropriate safeguards in the following cases:

• To implement agreements or serve national interests, standard provisions must be included in agreements.
• For transfers that are limited in scope or duration, standard contractual clauses or approval certificates are required, provided the data is not sensitive.
• Transfers necessary for internal operations within a multinational group require binding rules or standard clauses or entities to which data is transferred must have an approval certificate.
• Transfers to provide direct services or benefits are allowed if they align with the data subject's expectations and involve a certified entity, with non-sensitive data.
• Transfers necessary for research should be minimal and comply with standard clauses or be made to certified entities, with non-sensitive data.

The SDAIA may review the adequacy of appropriate safeguards specified in each exemption and amend these safeguards every two years or as needed.

The exemptions where data transfer outside the Kingdom is allowed under the appropriate safeguards are not applicable if:

• The controller fails to implement the appropriate safeguards.
• The SDAIA finds the safeguards inadequate for a specific case.

The Transfer Regulation requires a risk assessment before transfers that rely on one of the appropriate safeguards, and where sensitive personal data is transferred outside the Kingdom on a continuous or large-scale basis. SDAIA's Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (February 2025) outlines a four-phase approach, emphasizing the importance of integrating Data Transfer Risk Assessments (DTRA) into compliance workflows before any data is transferred. For more detail, see our overview of the Transfer Regulation.

1. Preparation Phase – Organizations must determine whether a risk assessment is required by evaluating factors such as data sensitivity, large-scale processing, and automated decision-making. This phase involves defining the purpose and legal basis for the transfer, describing the nature of data processing activities, and identifying data sources and geographical scope.
2. Assessing Negative Impacts and Potential Risks – Organizations must analyze vulnerabilities, potential threats, and the likelihood of security incidents. The risk assessment should examine material or moral effects on data subjects and ensure that only the minimum necessary data is transferred. This phase also evaluates compliance gaps, unauthorized access risks, and the broader societal impact of the transfer.
3. Risk Assessment for Data Transfer – Organizations must assess transfer-specific risks, including the recipient country’s legal framework, the adequacy of its data protection laws, and the security measures of the receiving entity. The assessment should ensure that safeguards align with legal requirements and that appropriate controls mitigate risks. If high risks persist, additional security measures or alternative data transfer mechanisms should be considered.
4. Implications for the Kingdom’s Vital Interests – Organizations must evaluate whether the transfer could impact national security, economic interests, or public order. If the assessment identifies significant risks, alternative processing methods should be explored.

j. National Register of Controllers

In line with the PDPL, SDAIA issued the Rules Governing the National Register of Controllers Within the Kingdom on 1 September 2024. This register plays a vital role in ensuring data protection compliance across the Kingdom by monitoring entities that process personal data and verifying their adherence to the PDPL. Registration on the National Data Governance Platform is mandatory for:

•  all public entities;
• controllers whose core activity involves processing personal data; and
• any controller that processes sensitive personal data.

Individuals who process personal data for purposes beyond personal or family use must also register.

To complete the registration on the National Data Governance Platform, every organization or individual must designate a representative. This representative is responsible for managing all registration formalities, including providing the entity's contact details and assessing the DPO appointment requirement as prescribed under the PDPL. Upon registration, entities receive a certificate valid for five years. This certificate is available for public verification and must be renewed to maintain compliance.

SDAIA's proposed 2025 amendments to the Implementing Regulations would move the registration criteria into the Regulations and extend mandatory registration to controllers that transfer or disclose personal data outside the Kingdom and controllers that process the data of individuals lacking full or partial legal capacity.

The National Data Governance Platform offers several essential services to help entities stay compliant:

• Report any personal data breaches within 72 hours;
• Submit and update DPO appointment details;
• Conduct a privacy impact assessment;
• Receive guidance on understanding and navigating the PDPL's requirements; and
• Conduct compliance assessments to ensure all standards and requirements are being met.

3. Data Subject Rights

Like most other data protection regulations globally, the PDPL ensures that all data subjects are guaranteed certain rights, known as data subject rights. The Implementing Regulations further expand upon these rights. These rights ensure that all users retain control over their data once it has been collected. Different data protection laws offer various different kinds of data subject rights. The ones guaranteed by the PDPL include the following:

a. Right to Know/Information

Data subjects have the right to know the legal basis and purpose for collecting their data, how it is collected and processed, the controller's contact details, and whether it will be disclosed to other parties or transferred outside the Kingdom.

b. Right to Access

Data subjects have the right to access their personal data.

c. Right to Request Correction

Data subjects have the right to request correction of any data collected on them if it is incomplete, inaccurate, or obsolete.

d. Right to Request Destruction

Data subjects have the right to request the destruction of data collected on them. The reasons can range from the user rescinding their consent for data collection to the data no longer serving the purpose for which it was collected.

e. Right to Limit/Restriction of Processing

The PDPL does not list a stand-alone right to restrict processing. Data subjects can, however, withdraw their consent at any time, and controllers must give them a simple way to opt out of direct marketing (Article 26).

f. Right to Data Portability

The data subjects can obtain their personal data in a legible and clear format and request their personal data to be transferred to another controller.

The data controller must ensure that all data subjects are appropriately informed about these rights and establish dedicated channels for data subjects to exercise these rights. The data controller must fulfill these requests within 30 days, extendable once by up to 30 days in justified cases provided the data subject is notified, and record all data subject requests received. The 30-day requirement is shorter than the GDPR's one month (extendable by two further months); thus, multinational organizations must act accordingly.

4. Regulatory Authority

SDAIA is the competent authority responsible for regulating and enforcing the PDPL within Saudi Arabia. Beyond levying penalties, SDAIA issues the Implementing Regulations, rules and guidelines; operates the National Data Governance Platform (controller registration, DPO notifications, breach reporting and compliance tools); receives complaints from data subjects; and, through its Committees for Reviewing Violations established under Article 36, investigates violations and imposes penalties. Those committees issued 48 decisions in 2025 (announced 16 January 2026).

When the PDPL was approved, the Council of Ministers designated SDAIA as the competent authority for an initial two years from the law's entry into force, after which a transfer of supervision to the National Data Management Office (NDMO) would be considered. That period ended in September 2025; SDAIA continues to act as the regulator, and no transfer has been announced.

5. Penalties for Non-Compliance

Under Article 35 of the PDPL, disclosing or publishing sensitive personal data with intent to harm the data subject or to obtain a personal benefit is punishable by imprisonment for up to two years and/or a fine not exceeding SAR 3 million (approx. USD 800,000); both organizations and individuals can, therefore, be sanctioned.

Under Article 36, violations of other provisions of the PDPL and its regulations attract a warning notice or a fine not exceeding SAR 5 million (approx. USD 1.3 million), which may be doubled for repeat violations. These fines are imposed by SDAIA's Committees for Reviewing Violations; in 2025 the committees issued 48 decisions confirming violations and imposing penalties. Data subjects who suffer damage as a result of a violation may also claim compensation before the competent court (Article 40).

6. How an Organization Can Operationalize PDPL

The PDPL's one-year transition period ended on 14 September 2024, so organizations that process the personal data of individuals in the Kingdom should already be operating in compliance. At a minimum, organizations should:

• Catalog their data inventories and classify sensitive personal data and personal data;
• Determine whether they must register on the National Register of Controllers and appoint a DPO, and complete both through the National Data Governance Platform;
• Disclose how personal data is being processed through transparent formal policies and privacy notices;
• Develop formal policies and procedures for data collection (consent framework etc.) and processing, and update privacy policies as needed;
• Have robust data breach notification mechanisms in place to meet the 72-hour deadline;
• Map their processes and discover cross-border data flows from Saudi Arabia to other countries, and, in the absence of an adequacy list, put appropriate safeguards (SCCs, BCRs or certification) and transfer risk assessments in place;
• Have a comprehensive data subject requests framework in place capable of responding within 30 days;
• Develop the capability to scan and track data processing activity and produce ROPA reports for compliance;
• Have technical and organizational security measures in place to protect their processing activities; and
• Conduct personal information protection impact assessments, vendor assessments, and other risk assessments.

7. How Securiti Can Help

Global privacy regulations expect organizations to be responsible custodians of their customers' data, and the PDPL is now actively enforced. Securiti's DataAI Command Platform helps organizations operationalize PDPL compliance end to end:

• Discover and classify personal and sensitive personal data across on-premises, cloud and SaaS systems;
• Manage consent and privacy notices in line with the PDPL's consent and transparency requirements;
• Automate data subject requests to meet the 30-day response window;
• Map data flows, maintain records of processing activities and assess cross-border transfers, including transfer risk assessments and SCC/BCR tracking;
• Run PDPL readiness, DPIA and vendor assessments; and
• Orchestrate breach response and 72-hour notifications to SDAIA.

Securiti can help you stay compliant with the PDPL and its accompanying regulations, and with other privacy and security regulations worldwide.

See how it works. Request a demo today.

Frequently Asked Questions (FAQs)