PDPL Penalties and Enforcement: What to Expect in 2026

SDAIA is gearing up for active PDPL enforcement in 2026 — understanding the penalty framework now gives businesses time to prepare before the first major fines are issued.

The Penalty Framework

The PDPL establishes both administrative and criminal penalties, with SDAIA as the primary enforcement authority and the public prosecution handling criminal cases.

Penalty Types

• Administrative fines up to SAR 5 million per violation
• Criminal penalties including imprisonment up to 2 years
• Data disclosure violations carry the harshest criminal penalties
• Repeated violations can result in doubled penalties
• SDAIA can order cessation of data processing activities
• Public naming of non-compliant organizations

Enforcement Timeline

SDAIA has been in an education-first phase since 2023, but signals point to active enforcement beginning mid-2026, with initial focus on high-profile sectors: e-commerce, healthcare, and financial services.

Expected First Cases

Based on enforcement patterns from GDPR and other frameworks, expect first major cases to target: large e-commerce platforms without consent banners, data brokers operating without registration, and companies with reported data breaches.

Prevention Checklist

• Implement a compliant CMP with Arabic support
• Publish a PDPL-specific Arabic privacy policy
• Establish DSAR handling procedures
• Register as a data controller with SDAIA
• Conduct a data protection impact assessment
• Document all cross-border data transfers
• Train staff on data protection obligations