Sep 19, 2025
Tanay Rai
As organizations in Saudi Arabia accelerate digital transformation, personal data has become both a critical asset and a significant risk vector. To safeguard individuals’ privacy and ensure responsible data use, the Kingdom has enacted the Personal Data Protection Law (PDPL), which came into force after a 720-day transition period from its publication.
The PDPL aligns the Kingdom with global privacy trends such as the EU’s GDPR, while maintaining strong local regulatory oversight. For businesses, compliance is not optional; it’s a prerequisite for maintaining trust, avoiding penalties, and enabling cross-border operations.
What is Saudi Arabia’s Personal Data Protection Law (PDPL)?
The Personal Data Protection Law (PDPL) is the Kingdom’s first comprehensive framework for regulating how personal data is collected, processed, stored, and shared. Issued in 2021 and enforced after a 720-day transition period, the PDPL aims to protect individuals’ privacy, enhance trust in digital services, and align Saudi Arabia with global standards such as the EU’s GDPR.
Core Objectives
Safeguard Privacy: Ensure individuals’ personal and sensitive data is handled responsibly.
Establish Rights: Give individuals the right to access, correct, obtain, or erase their data.
Regulate Processing: Require lawful bases for processing, with consent as the default.
Strengthen Governance: Impose obligations on organizations (controllers and processors) to maintain policies, security measures, and impact assessments.
Control Data Transfers: Restrict cross-border data flows unless the receiving country offers equivalent protection or special conditions are in place.
Enforce Compliance: Introduce penalties, including fines up to SAR 5 million and imprisonment for sensitive data misuse.
Who Does PDPL Apply To?
The PDPL has a broad jurisdictional scope:
Domestic Processing
Applies to any processing of personal data inside the Kingdom, regardless of whether manual or automated.
Covers public and private sector entities, as well as individuals acting as controllers or processors.
Extraterritorial Application
Extends to foreign companies outside the Kingdom that process data of individuals residing in Saudi Arabia.
This ensures Saudi residents’ data remains protected even if processed abroad.
Special Coverage
Includes data relating to deceased individuals, if the data could identify them or their family members.
Exemptions
Processing strictly for personal or family use is exempt, provided the data is not published or disclosed publicly.
The implementing regulations provide further details on what qualifies as “personal and family use.”
This broad applicability ensures that organizations cannot escape accountability by outsourcing or moving data operations outside the Kingdom.
What are The Key Definitions Under PDPL?
The law provides precise terminology to eliminate ambiguity:
Personal Data: Any information that directly or indirectly identifies an individual (e.g., names, ID numbers, contact details, financial records, photos).
Sensitive Data: Includes racial/ethnic origin, religious or political beliefs, biometric and genetic data, health records, and criminal history.
Data Subject: The individual to whom the data relates.
Controller: Entity (public or private) that determines the purpose and means of processing.
Processor: Entity processing data on behalf of a controller.
Processing: Any action on data collection, storage, disclosure, transfer, modification, erasure, etc.
These definitions align with global best practices while addressing Saudi-specific sensitivities, particularly in relation to religion, health, and public safety.
What Rights Do Individuals Have Under PDPL?
The PDPL empowers individuals with strong rights to control their data. These rights are enforceable, and organizations must establish procedures to honor them:
Right to Information: Individuals must be informed of the legal basis and purpose of data collection.
Right of Access: Individuals can access their personal data held by controllers, with some security and judicial limitations.
Right to Portability: Ability to obtain data in a clear, readable format, enabling portability across services.
Right to Rectification: Correction, completion, or updating of inaccurate or incomplete data.
Right to Erasure (Right to be Forgotten): Individuals can request the destruction of personal data once it is no longer required for legitimate purposes.
These rights signal a shift in power from organizations to individuals, a cornerstone of modern privacy regimes.
When Is Consent Required?
General Rule
Data processing requires the explicit consent of the data subject. Consent must be informed, freely given, and not bundled as a condition for unrelated services.
Exceptions to Consent
Processing may occur without consent in specific cases:
Vital Interests: Protecting life, health, or safety when contacting the subject is impossible.
Legal Obligations: Processing mandated by law or previous agreements.
Public Entities: Processing necessary for security, public interest, or judicial requirements.
Legitimate Interests: Processing aligned with the controller’s interests, provided no sensitive data is involved and the subject’s rights are not compromised.
This balance ensures flexibility for operational needs while prioritizing the rights of data subjects.
What Must Organizations Do to Comply?
Controllers shoulder the heaviest compliance responsibilities under PDPL:
Data Minimization
Collect only what is necessary for a legitimate purpose.
Cease collection and destroy data once the purpose is achieved.
Accuracy and Integrity
Verify that personal data is complete, accurate, and relevant.
Transparency
Publish a clear privacy policy before collection.
Inform subjects about:
Purpose of collection.
Entities receiving their data.
Transfer of data abroad.
Potential consequences of refusing collection.
Security Measures
Implement technical, organizational, and administrative safeguards.
Cover data during storage, transfer, and processing.
Breach Notification
Notify the Competent Authority of breaches, damages, or illegal access.
Inform affected data subjects if their rights or interests are at risk.
Impact Assessments
Conduct data protection impact assessments (DPIAs) for products and services with significant processing activities.
These obligations reinforce accountability and governance within organizations.
How Are Special Data Categories Handled?
Certain types of data are given heightened protection under PDPL:
Health Data:
Access is restricted to the minimum personnel required for medical services.
Processing is limited to necessary health service delivery and insurance.
Credit Data:
Explicit consent is required for collection, disclosure, or publishing.
Individuals must be notified when their credit data is requested.
Research and Statistics:
Processing is allowed without consent if the data cannot identify individuals or if identifiers are destroyed before disclosure.
This ensures sensitive data categories are handled responsibly and securely.
Can Data Be Sent Outside Saudi Arabia?
Cross-border data transfers are highly regulated to protect sovereignty and individual privacy:
Allowed when:
Required by international agreements.
Serving the Kingdom’s interests.
Fulfilling contractual obligations with the data subject.
Conditions:
No prejudice to national security or vital interests.
The recipient jurisdiction must have equivalent protection as PDPL.
Transfer is limited to the minimum data required.
Exceptions:
Emergencies to preserve life or prevent/treat disease.
This reflects Saudi Arabia’s intent to keep data sovereignty intact while still enabling global business.
What Happens If You Don’t Comply?
The PDPL includes strict enforcement mechanisms to ensure compliance:
Sensitive Data Violations:
Up to 2 years imprisonment, SAR 3 million fine, or both.
General Violations:
Fines up to SAR 5 million, warnings, or doubling of penalties for repeat offenses.
Compensation:
Individuals may claim damages for material or moral harm.
Supervisory Authority:
A Competent Authority (appointed by the Council of Ministers) oversees enforcement, maintains a national register of controllers, and issues licenses for audits/accreditations.
This dual framework of punitive penalties and regulatory oversight enforces both deterrence and proactive compliance.
How Does PDPL Compare Globally?
While inspired by GDPR, the PDPL contains unique local adaptations:
Consent: Explicit consent is central, with fewer lawful bases compared to GDPR.
Deceased Data: Extends protection to deceased individuals — not common in other regimes.
Cross-Border Transfers: Conditional on adequacy and sovereignty, more restrictive than GDPR.
Cultural Sensitivities: Sensitive data categories reflect Saudi religious and social priorities.
For global businesses, this means that compliance cannot be a copy-and-paste from the GDPR; tailored policies are required.
What Should Businesses Do Next?
Organizations operating in Saudi Arabia must take immediate compliance actions:
Governance
Appoint a Data Protection Officer (DPO) where required.
Establish clear reporting lines to the Competent Authority.
Policies and Processes
Draft and publish transparent privacy policies.
Implement data subject request (DSR) handling procedures.
Technical Safeguards
Encrypt sensitive data.
Implement strong access controls and monitoring.
Training and Awareness
Educate staff on PDPL obligations and rights.
Establish breach response protocols.
Cross-Border Readiness
Review international data flows and contracts.
Implement safeguards for transfers.
Companies that move early will not only reduce compliance risks but also differentiate themselves by building trust with customers and regulators.
