PDPL (Personal Data Protection Law)

The Personal Data Protection Law (PDPL) is Saudi Arabia's primary data protection legislation, enacted by Royal Decree M/19 on September 14, 2021, with full enforcement beginning in September 2023. Overseen by the Saudi Data and AI Authority (SDAIA), the PDPL establishes comprehensive rules governing how organizations collect, process, store, and transfer personal data of individuals residing in the Kingdom of Saudi Arabia. The law applies to all entities — public and private, domestic and international — that handle personal data of Saudi residents. Personal data under the PDPL includes any information that can directly or indirectly identify an individual, such as names, national identification numbers, contact details, digital identifiers, and biometric data. Sensitive personal data, including health records, genetic information, religious beliefs, ethnic origin, and financial data, receives heightened protections. Organizations must obtain explicit, informed consent before processing personal data unless a lawful exception applies. Data subjects enjoy extensive rights including the right to access their data, request correction of inaccurate information, request deletion, withdraw consent, and be informed about processing purposes and legal bases. Cross-border data transfers are restricted and require adequate protections or explicit consent. Organizations must conduct data protection impact assessments for high-risk processing, appoint data protection officers in certain circumstances, and notify SDAIA within 72 hours of discovering a data breach. Non-compliance carries significant penalties: administrative fines up to SAR 5,000,000, with potential imprisonment for serious violations including unauthorized disclosure of sensitive personal data. The PDPL represents a major step in Saudi Arabia's digital transformation and Vision 2030 goals.