Contact Us See a demo

Saudi Arabia’s Personal Data Protection Law (PDPL)

Last Updated on September 30, 2026

Saudi PDPL Deadline Passed.
Compliance Didn't.

Now comes the operational work: know where Saudi personal data is stored, keep your records up to date, and be ready to prove your controls to SDAIA.

See It in Action
Schedule your demo today

In September 2021, the Council of Ministers in Saudi Arabia approved the Personal Data Protection Law (PDPL).

Saudi PDPL has been fully enforceable since September 2024, and SDAIA is issuing penalties. In January 2026, SDAIA's committees for reviewing PDPL violations reported 48 decisions confirming violations and imposing penalties on data controllers. The violations included:
- processing and disclosing personal data without legal justification,
- failing to implement appropriate organizational and technical safeguards, and
- sending marketing messages without consent.

Your policies and assessments are in place. The hardest part is keeping them true as your data changes: knowing where personal data lives, keeping your RoPA current, managing rights and transfers at scale, and proving it all when SDAIA asks.

The solution

Securiti, a Veeam company, helps organizations run Saudi PDPL as an ongoing operation rather than a one-time project. Our PrivacyOps, an integration of the DataAI Command Platform™, solution connects personal data discovery, records of processing, data subject rights, consent, retention, and cross-border transfers in one place. That way, your program can answer the most important questions:

- Do you know where personal data lives?
-Are your records of processing still accurate?
- Can you manage rights, retention, consent, and transfers at scale?
- Can you prove what happened if SDAIA asks?

With PrivacyOps, you can:

- Discover and classify personal and sensitive data across cloud, SaaS, and on-premises systems, including bilingual Arabic and English data.
- Automate rights requests, consent, retention, and transfer controls as your data and processing change.
- Keep your RoPA, assessments, and processing records audit-ready, with evidence you can produce when SDAIA asks.

Continuous visibility. Automated privacy operations. Evidence on demand.

Saudi Arabia PDPL Compliance Solution

Request a demo to see how Securiti gives your team the evidence to show your PDPL program is working.

 

Customize a Data Subject Rights Request Portal for Seamless Customer Care

Create customized web forms aligned with your brand image using the DSR request format, and accept verified data subject rights requests. Automate the initiation of fulfillment workflows upon receipt of verified requests.

Saudi Arabia PDPL data subject rights request
France DPA Data Subject Request Workbench

Automate Data Subject Request Handling

Articles: PDPL 4, 21; Implementing Regulation 3, 4, 5, 6, 7, 8

Data subjects need to be notified about their data privacy rights, and organizations are required to simplify the initiation of verified DSR requests. Automating the delivery and generation of secure data access reports will greatly reduce the risk of compliance violations and reduce the workforce required to comply with all requests.

Secure Fulfillment of Data Access Requests

Articles: PDPL 4(2), 9, 21; Implementing Regulation 3, 4(3), 6

Disclosure of information to data subjects within a limited time frame after receiving a verifiable data request is a must for any organization seeking to comply. This will be free of charge and delivered through a secure, centralized portal.

Saudi Arabia PDPL data access requests
France DPA Data Subject Request Workbench

Automate Processing of Rectification/Completion & Updation Requests

Articles: PDPL 44(4), 17, 21; Implementing Regulation 7

With the help of automated data subject verification workflows across all appearances of a subject’s personal data, you can seamlessly fulfill all personal data rectification, completion, and update requests.

Automate Erasure Requests

Articles: PDPL 4(5), 21; 18(1) Implementing Regulation 8

Fulfill data subjects' erasure requests through automated, flexible workflows that reach every system holding their personal data. Keep a record of what was destroyed and when.

Saudi Arabia PDPL erasure requests
restriction of processing requests

Automate Objection and Restriction of Processing Requests

Article: Implementing Regulation 7(1), 16(4)

Build a framework for handling objections and restrictions on processing based on business requirements, using collaborative workflows.

Automate People Data Graph

Articles: PDPL 31; Implementing Regulation 33

Discover personal information stored across all your internal and external systems within the organization and link them back to a unique data subject. Also, visualize personal data sprawl and identify compliance risks.

cookie consent tracking
France DPA Data Subject Request Workbench

Meet Cookie Compliance

Articles: PDPL 5, 6, 7; Implementing Regulation 11, 12

Automatically scan the web properties within your organization and categorize tags and cookies. Also, build customizable cookie banners, collect consent, and provide a preference center.

Monitor and Track Consent

Articles: PDPL 5, 6, 7, 10(1), 15(1), 24(1), 25(1), 26, Implementing Regulation 11, 12, 13 Personal Data Transfer Regulation Outside the Kingdom 2.

Track data subjects' consent revocations to prevent the transfer or processing of data without their consent. Seamlessly demonstrate consent compliance to regulators and data subjects and fulfill any consent revocation requests

Monitoring And Tracking Personal Data
track consent

Assess Saudi PDPL Readiness

Articles: PDPL 10, 11, 14, 19, 22, 30, 31; Implementing Regulation 25, 16(3); Regulation on Personal Data Transfer Outside the Kingdom 7.

With the help of Securiti’s multi-regulation, collaborative, readiness, and personal information impact assessment system, you can gauge your organization's posture against Saudi PDPL requirements, identify the gaps, and address the risks. Seamlessly expand assessment capabilities across your vendor ecosystem to maintain compliance against Saudi PDPL.

Map Data Flows

Articles: PDPL 15, 19, 28, 30, 31; Implementing Regulations 2, 6, 18(1)(b), 19(1)(a), Personal Data Transfer Regulations Outside the Kingdom 2, 4, 5

Track data flows in your organizations, trace this data, catalog, transfer, and document business process flows internally and to service providers or third parties in and outside the Kingdom. Additionally, the controller must take appropriate measures to ensure that its employees are adequately trained and informed about the PDPL’s provisions on individuals' rights, breach notification, and security-threat procedures.

Saudi Arabia PDPL data subject rights request
Saudi Arabia PDPL data subject rights request

Govern Personal Data Transfers Outside the Kingdom

Articles: PDPL 19, 29; Implementing Regulations 2, 6, 7, 8 Regulation on Personal Data Transfer Outside the Kingdom 2, 3, 4, 5, 6, 8

Securiti maps every system, vendor, and cloud region that holds Saudi personal data, flags flows leaving the Kingdom, and links each transfer to its purpose, safeguards, and risk assessment. When a transfer's volume or sensitivity changes, you know it's time to reassess.

Assess Third Parties

Article: PDPL 8; Implementing Regulation 5(1), 15, 17 (3)

Keep track of privacy and security readiness for all your service providers and processors from a single interface. Collaborate instantly with vendors, automate data requests and deletions, and manage all vendor contracts and compliance documents.

Assess Third Parties
Saudi Arabia PDPL data subject rights request

Breach Response Notification

Articles: PDPL 20; Implementing Regulations 2(3)(c), 17(1)(d), 23, 24

Automates compliance actions and breach notifications to concerned stakeholders in relation to security incidents by leveraging a knowledge database on security incident diagnosis and response.

Privacy Policy and Notice Management

Articles: PDPL 4(1), 12, 13; Implementing Regulation 4(3)

Automate your privacy notice publishing with pre-built templates to speed up the process. Enable centralized management by tracking and monitoring privacy notices to maintain compliance.

Privacy Policy and Notice Management
Saudi Arabia PDPL data subject rights request

Enforce Retention and Minimization

Articles: PDPL 11, 18; Implementing Regulation 4(1)(d), 19, 33(5)(e)

The PDPL limits organizations to collecting personal data only to the extent necessary for a specific purpose, and to retaining it only as long as the purpose is served. Identify redundant, obsolete, and trivial personal data, and apply retention rules by purpose and data category

Govern the Personal Data Feeding AI

Articles: PDPL 1(5), 2, 22, 31(, Implementing Regulation 4(5)(c), 9, 11(2)(c), 19, 25(1)(c), 33

Saudi Arabia's AI transformation runs on data. When it's personal or sensitive, PDPL applies across its lifecycle, from collection to transfer. Governing AI starts with knowing which processing activities feed models, copilots, and agents, and evidencing them in an audit-ready RoPA. Discover and classify that data, flag high-risk uses like automated decisions, control access, enforce minimization and retention, and evidence what data was used, where, and by whom.

Privacy Policy and Notice Management

Key Rights Under Saudi PDPL

Right to be Informed

Data subjects have the right to information that includes informing data subjects of the legal or practical justification for collecting their personal data, the purpose of that collection, and that their data should not be processed in a manner inconsistent with the purpose of its collection.

Right to Access

Data subjects have the right to access their personal data from the entity and obtain a copy of it in a clear and readable format, in conformity with the content of the records, at no cost. There are a few exceptions to this right.

Right to Correction

When data subjects discover that their personal information is incorrect or incomplete, they have the right to request that an entity correct or complete it.

Right to Destruction

Data subjects have the right to request the destruction of data that is no longer needed or that was collected illegally.

Right to Data Portability

Data subjects have the right to obtain their personal data in a clear, legible format and to request that it be transferred to another controller.

Key Facts about Saudi PDPL

1

The Saudi Data & Artificial Intelligence Authority (SDAIA) is the competent authority enforcing the PDPL. The law allowed for supervision to move to the National Data Management Office (NDMO) after an initial period, but SDAIA continues to lead enforcement.

2

Organizations must appoint a Data Protection Officer (DPO), if their core activities involve processing personal data on a large scale, regular and systematic monitoring of data subjects, or processing of sensitive personal data as per the SDAIA Rules for Appointing Personal Data Protection Officers. 

3

Sensitive data includes personal data that reveals racial or ethnic origin or religious, intellectual, or political beliefs. It also covers security and criminal data; biometric or genetic data used to identify a person; health data; and data indicating that one or both of an individual's parents are unknown.

4

The collection of personal data should be limited to the minimum necessary to achieve the specified purposes.

5

Individuals who unlawfully disclose sensitive data with the intent to harm the data subject or to gain personal benefit may face imprisonment for up to 2 years, a fine of up to 3 million Riyals, or both. Repeat offenders may face doubled fines. 

6

For other violations of the PDPL, fines can be as high as five million Riyals, with penalties doubled for repeated infractions. 

7

The PDPL requires data to be retained for as long as necessary to achieve the specific purposes for which it was collected, or only as required by the PDPL. The Implementing Regulations also state the kind of information that should be included in a ROPA.

8

The Implementing Regulations introduce a National Register of Controllers for registering controllers with SDAIA. The SDAIA has issued The Rules Governing the National Register of Controllers Within the Kingdom, to facilitate registration.

9

The Personal Data Transfer Regulations, updated in September 2024, provide evaluation criteria for assessing the level of personal data protection in countries, sectors, and organizations outside the KSA. They also set out the safeguards that apply to transfers.

10

Enforcement is active. In January 2026, SDAIA's violation review committees reported 48 decisions confirming PDPL violations and imposing penalties on data controllers.

Analyze this article with AI

ChatGPT Claude Perplexity Grok
Prompts open in third-party AI tools.
IDC MarketScape

Securiti named a Leader in the IDC MarketScape for Data Privacy Compliance Software

Read the Report
Please enter a minimum of 3 characters to begin your search.

Type

Videos
View More
March 9, 2026
Rehan Jalil, Veeam on Agent Commander : theCUBE + NYSE Wired: Cyber Security Leaders
Following Veeam’s acquisition of Securiti, the launch of Agent Commander marks an important step toward helping enterprises adopt AI agents with greater confidence. In...
View More
January 20, 2025
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
January 15, 2025
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
January 2, 2025
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
December 24, 2024
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
November 1, 2024
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
October 29, 2024
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
August 12, 2024
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
June 3, 2024
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
January 29, 2024
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...

Spotlight Talks

Spotlight 59:11
Data Controls for AI: Findings from the 2026 GigaOm DSPM Research
Watch Now View
Spotlight 1:02:06
Consent by proxy: When AI agents start deciding for us
Watch Now View
Spotlight 1:00:41
Future-Proofing for the Privacy Professional
Watch Now View
Spotlight 50:52
From Data to Deployment: Safeguarding Enterprise AI with Security and Governance
Watch Now View
Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight
Choosing the Right DSPM: An Industry Analyst’s Perspective
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Latest
Australia’s Office of AI: Why Annual Audits Miss What Your AI Can Reach View More
September 15, 2026
Australia’s Office of AI: Why Annual Audits Miss What Your AI Can Reach
Picture this: a fictional but entirely plausible scenario. An Australian financial institution's AI systems spend six months accessing a customer data repository nobody has...
View More
September 9, 2026
A Complete DSPM Needs Classification and Context
Classification is one of the core functions a DSPM program handles, and it usually runs in tandem with discovery, since together they form the...
View More
September 29, 2026
DSPM for AI: Extending Data Posture to Prompts, Pipelines & Agents
Learn how DSPM for AI helps enterprises discover sensitive data, assess exposure, govern access, reduce risk, and secure data before AI systems and agents...
DSPM vs DLP: Key Data Security Differences Explained View More
September 29, 2026
DSPM vs DLP: Key Data Security Differences Explained
Compare DSPM vs DLP to understand how they differ in data discovery, classification, monitoring, prevention, risk reduction, and protecting sensitive enterprise data.
The Context Layer for Data+AI Security View More
September 21, 2026
The Context Layer for Data+AI Security
Discover how Securiti’s DataAI Command Graph connects data, identity, cloud, and AI findings to uncover contextual risk and toxic combinations.
View More
September 21, 2026
Privacy RFP Buyer’s Guide: 120+ Questions to Evaluate Privacy Automation Platforms
Download the Privacy RFP Buyer’s Guide with 120+ practical questions to evaluate privacy automation platforms across compliance, security, integrations, governance, and scalability.
The Toxic Combination Problem in DataAI Risks View More
September 21, 2026
The Toxic Combination Problem in DataAI Risks
Discover how siloed security alerts create hidden toxic risk combinations and how correlated context helps reduce alert fatigue and uncover compound risks faster.
The Cloud Storage Bill Nobody Reads View More
August 31, 2026
The Cloud Storage Bill Nobody Reads
Hidden cloud storage costs add up fast. Learn how redundant, obsolete, and trivial data drives unnecessary spend, expands risk, and why automated data minimization...
View More
February 18, 2026
Take the Data Risk Out of AI
Learn how to prepare enterprise data for safe Gemini Enterprise adoption with upstream governance, sensitive data discovery, and pre-index policy controls.
View More
December 22, 2025
Navigating HITRUST: A Guide to Certification
Securiti's eBook is a practical guide to HITRUST certification, covering everything from choosing i1 vs r2 and scope systems to managing CAPs & planning...
What's
New