CyphrQ
Menu

Saudi PDPL Requirements: What Organisations Must Do Now

What Saudi Arabia's Personal Data Protection Law requires: scope, consent, 72-hour breach reports, transfers, registration, fines, and a checklist.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

13 min read

What does Saudi Arabia's Personal Data Protection Law (PDPL) require of organisations? In short: a lawful basis for every use of personal data, a published privacy policy, security measures, written records of processing, a report to the regulator within 72 hours of a breach that could cause harm, safeguards when data leaves the Kingdom, and registration for many controllers. The regulator is SDAIA, the Saudi Data and AI Authority.

This is not legal advice. Read it as a simple guide to the PDPL from CyphrQ.ai. Every point links to an official page, so your legal adviser can confirm it.

Updated 25 October 2026.

A note on sources. The official PDPL pages run by SDAIA on its Personal Data Protection Platform carry the law and regulations in Arabic. The "En" toggle on the pages I opened showed Arabic. English versions in circulation are translations, and I have not treated any of them as official.

The article numbers below are from SDAIA's Arabic text, and I could not check them against an official English version. Confirm each one with the official text or a lawyer before you rely on it. The English wording is my summary, not a quotation.

Does the Saudi PDPL apply to your organisation?

Very likely, if you handle personal data about people in Saudi Arabia. Article 2 of the law applies to the processing of personal data of individuals in the Kingdom by any means. It also reaches organisations outside the Kingdom that process the data of people resident in it (PDPL, Article 2). Purely personal or family use is excluded, as long as the data is not published or disclosed.

So a company in Dubai, London or Cairo with Saudi customers can be in scope. Where you are incorporated is not the test. Where the people are is.

The law talks about the "controller" (the organisation that decides why and how data is processed) and the "processor" (the one that handles it on the controller's behalf). If you buy a cloud service, a payroll tool or an AI assistant, you are normally the controller and the vendor is your processor.

For a comparison with the neighbouring regime, see the UAE PDPL explainer. The two laws share a name and little else in their detail.

What does the Saudi PDPL require organisations to do?

The law itself sets the principles. The Implementing Regulations, issued under it, fill in the working detail. Taken together, these are the duties I found on the official pages:

Duty Where it sits What it asks
Lawful basis Law, Articles 5 and 6 Consent by default, with listed exceptions
Tell people what you do Law, Article 12; Regulations, Article 4 A privacy policy, and a notice before or at collection
Keep data accurate Law, Article 14 Steps to check data is accurate, complete and current
Protect data Law, Article 19 Organisational, administrative and technical measures, including during transfer
Report breaches Law, Article 20; Regulations, Article 24 Notify the authority, and individuals where harm is possible
Keep records Law, Article 31; Regulations, Article 33 Written records of processing activities
Answer people's requests Regulations, Article 3 Within 30 days
Assess risk Regulations, Article 25 A written assessment for listed high-risk processing

The next sections take the ones that cause most trouble in practice.

When can you process personal data under the Saudi PDPL?

With consent, unless an exception applies. Article 5 makes consent the general requirement and lets people withdraw it at any time. Article 6 then lists exceptions, including processing required by another law and processing for the controller's legitimate interests. Legitimate interests do not cover sensitive data (PDPL, Articles 5 and 6).

In Saudi Arabia, "legitimate interests" exists as a route. But the Implementing Regulations make it conditional. Article 16 allows it only where listed conditions are met, and requires you to carry out and document an assessment of the proposed processing before relying on it (Implementing Regulations, Article 16).

In practice: if your marketing team wants to reuse customer data for a new campaign, you need either consent or a written legitimate-interests assessment on file. A verbal "we think it's fine" will not survive a regulator's questions.

On notice: before or at collection, Article 4 of the regulations requires you to take the steps needed to tell people who you are, why you collect the data, how long you keep it and what rights they have. Article 12 of the law adds a privacy policy that you adopt and make available (PDPL, Article 12). SDAIA also publishes a Privacy Policy Preparation Guideline on the same platform.

How fast must you report a breach under the Saudi PDPL?

Within 72 hours, if the breach could harm personal data or the people it concerns. The law (Article 20) says the controller must notify the competent authority and, where harm is possible, the affected individuals, but leaves the detail to the regulations. Article 24(1) of the Implementing Regulations sets the period: no more than 72 hours from when the controller becomes aware of the incident. Individuals must be told "without undue delay", in plain language (Article 24(5)) (Implementing Regulations, Article 24).

The clock starts when you know, not when the investigation ends. The controller registration rules repeat the same 72-hour figure at Article 12(1) (National Register rules). The platform itself lists a personal data breach notification service next to its registration and impact assessment tools (SDAIA platform).

What to do this week: work out who in your organisation would decide that an incident is a "breach that could cause harm", and who would file the report. If the answer is "we'd work it out on the day", write it down now.

Can you send personal data outside Saudi Arabia under the PDPL?

Yes, under conditions. Transfers are governed by Article 29 of the law and by a separate Regulation on Personal Data Transfer Outside the Kingdom, which I read on the official platform (Transfer Regulation).

The regulation gives you two main routes:

  • Adequacy. Under Article 3, the competent authority publishes a list of countries or international organisations that give adequate protection, reviewed every four years or as needed. It can amend the list and can suspend transfers to listed destinations.
  • Appropriate safeguards. Article 4(1) names three: standard contractual clauses, binding common rules (the group-wide equivalent of binding corporate rules) and certification.

Article 4(2) then lists transfers that can go ahead under safeguards even without adequacy. They include government-to-government transfers, occasional transfers affecting a limited number of people, transfers needed for central operational processing within a multinational group, transfers that directly serve the data subject's interest, and scientific research. Several of these exclude sensitive data.

Before relying on the exemptions, or before moving sensitive data, or data continuously or at large scale, you must complete a transfer risk assessment under Article 7. I did not find a duty in that regulation to notify SDAIA of a transfer. The only notification duty I found there, in Article 6(2), is to tell the recipients to stop when an exemption is withdrawn.

If your tools are hosted abroad, as many SaaS and AI tools are, this is the section that matters most.

Who must register as a controller in Saudi Arabia?

Four groups. Under Article 2 of SDAIA's rules for the National Register of Controllers, registration is required where the controller is a government entity, where its main activity involves processing personal data, where it processes sensitive data, or where an individual processes personal data beyond personal or family use (National Register rules).

How it works:

  • Registration is done on the platform by a designated representative. Government entities are designated by a form from the authority. Private entities designate a representative on the platform (Article 3).
  • You enter the organisation's profile and, where a data protection officer (DPO) is appointed, the DPO's details (Articles 5 and 7).
  • On completion you receive a registration certificate, valid for up to five years (Article 10).
  • You are notified 30 days before expiry. After expiry you can use platform services for no more than five days before a renewal request is needed.

The platform's front page offers registration paths for government, private, non-profit and foreign entities (SDAIA platform). The rules I read did not mention a fee.

What are the penalties under the Saudi PDPL?

Two tiers, set in Articles 35 and 36 of the law (PDPL):

  • Article 35, criminal. Disclosing or publishing sensitive data in breach of the law, with intent to harm or for personal gain, carries imprisonment of up to two years and/or a fine of up to SAR 3 million.
  • Article 36, administrative. Any other violation can draw a warning or a fine of up to SAR 5 million. Fines can be doubled for repeat violations, within a cap of twice the maximum.

Article 40 separately lets anyone harmed by a violation claim material or moral damages in court.

I looked for official enforcement announcements and did not find a primary SDAIA statement with decision-level detail. I have not read an official source for enforcement figures, so I am not repeating any. If someone quotes you "the number of decisions so far" or "the average fine", ask for the SDAIA or Saudi Press Agency reference.

What changes are proposed to the Saudi PDPL regulations?

SDAIA has published draft amendments to the Implementing Regulations for consultation. Clyde & Co reports that the consultation opened on 6 October 2026 and closes on 5 November 2026, and that the changes would take effect 60 days after publication in the Official Gazette, if adopted (Clyde & Co, October 2026).

Per that summary, the proposals include:

  • A new Article 23 requiring controllers to store personal data inside Saudi Arabia, while still allowing transfers and disclosures under the law.
  • The 72-hour report to SDAIA applying to all personal data breaches, without a harm threshold.
  • Impact assessments in more cases, including processing of minors' data, large-scale or systematic monitoring, emerging technologies and significant automated decisions.
  • Wider mandatory registration and broader DPO triggers.
  • A 20-business-day deadline to respond to SDAIA requests.

I read this in a law firm's summary, not in SDAIA's draft, so treat it as a heads-up. Nothing here is in force. Comments go through the public consultation platform, Istitlaa. If you operate in Saudi Arabia, read the draft itself before 5 November.

What is a Saudi PDPL compliance checklist?

  1. Have you mapped every system that holds personal data about people in the Kingdom, including vendors?
  2. For each use, can you point to consent or a documented exception?
  3. Is your privacy policy published, and does your collection notice match it?
  4. Is there a named owner and a written plan for reporting a breach to SDAIA within 72 hours?
  5. Do you keep records of processing, and will you keep them for the five years after each activity ends?
  6. For every vendor outside the Kingdom, which transfer route do you rely on, and where is the risk assessment?
  7. Do you fall into one of the four registration groups, and is your certificate in date?
  8. Can you answer a request from a person within 30 days?

Going deeper: for security and IT teams

The legal duties turn into five pieces of operational evidence: records, breach runbooks, transfer files, a DPO decision, and impact assessments with a request process. SDAIA's own guidance, in Arabic, is the best place to start.

Records of processing activities. Law Article 31 requires them, and Article 33(1) of the Implementing Regulations says to keep them for as long as the processing continues plus five years from the date it ends. Article 33(4) and (5) require the records to include specified details and to be made available to SDAIA on request. SDAIA's guideline for processing activity records lists the minimum fields (SDAIA records guideline):

  • controller identity and contact details;
  • DPO details, where one must be appointed;
  • purposes of processing;
  • categories of personal data and of data subjects;
  • retention periods, by category where feasible;
  • recipients, and categories of recipients;
  • cross-border transfers, with legal grounds and recipients;
  • a description of security measures, where feasible.

Build the record from your data flow diagram, one entry per purpose. It is the document you hand to SDAIA, and the first one your DPO will want.

Breach notification steps. Article 24 of the regulations is the one to turn into a runbook. The steps that follow from the text:

  1. Triage: decide whether the incident could harm personal data or the person it concerns. That decision is the trigger for Article 24(1).
  2. Start the 72-hour clock from the time you became aware, and log that time.
  3. File through the breach notification service on the platform (SDAIA platform).
  4. Tell affected individuals without undue delay, in plain language (Article 24(5)).
  5. Keep the evidence: timeline, scope, containment, decisions.

I read Article 24(1) and (5) closely. I did not read every sub-paragraph, for example what the notice must contain, so check the full article before you finalise the template. Note also the proposed change above: the draft would remove the harm threshold for the report to SDAIA.

Transfer mechanisms. The Transfer Regulation gives you Article 3 adequacy, Article 4(1) safeguards (standard contractual clauses, binding common rules, certification), Article 4(2) exemptions and an Article 7 risk assessment. Article 7(2) lists what the assessment covers: the purpose and legal basis, the nature and geographic scope, the adequacy of safeguards, data minimisation measures, possible material or moral impact, and measures to prevent or reduce risk. SDAIA also publishes a guideline for assessing the risks of transferring personal data outside the Kingdom. Keep a file per vendor and region: route relied on, assessment, signed clauses, sub-processor list. Article 6 means the file must be able to support stopping a transfer, so know how you would suspend a data flow.

Data protection officer. Article 32(1) of the regulations requires a controller to appoint or designate one or more people responsible for personal data protection in listed cases, such as public bodies with large-scale processing or core activities involving sensitive data. Article 32(3) gives the DPO oversight of compliance, handling of requests and liaison with the authority. The register rules tie this to registration, since the representative decides whether a DPO is needed and enters the DPO's details. The draft amendments would broaden the triggers.

Impact assessments and requests. Article 25(1) requires a written, documented assessment of impacts and risks to the data subject for sensitive data, data matching and certain high-risk activities. Article 3(1) sets the 30-day window for requests, extendable by up to 30 days with notice to the individual.

Questions for vendors and auditors.

  • Where is data stored and processed, and can you confirm in writing?
  • Which Article 4(1) safeguard do you offer, and who signs?
  • Who are your sub-processors, and how are changes announced?
  • Can you support a 72-hour notification, and what do you send us, and when?
  • How would you delete one person's data within 30 days?

Key takeaways

  • The Saudi PDPL applies to processing of personal data of individuals in the Kingdom, including by organisations outside it (Article 2).
  • Consent is the default basis. Legitimate interests is an exception route, but it is conditional and needs a documented assessment (Article 16 of the regulations).
  • Report a breach that could cause harm to SDAIA within 72 hours of becoming aware (Regulations, Article 24(1)).
  • Keep records of processing for the life of the activity plus five years (Regulations, Article 33(1)).
  • Fines go up to SAR 5 million for administrative violations, and up to SAR 3 million with up to two years in prison for harmful disclosure of sensitive data (Articles 35 and 36).
  • Draft amendments, open for comment until 5 November 2026, would add data localisation and wider breach reporting. Nothing in them is in force yet.

Sources

All SDAIA pages below were accessed on 25 October 2026.