Launching in Saudi Arabia?
Consent is on the critical path.
Most of a Saudi launch is logistics, payments and Arabic. The part that quietly slips is consent — because PDPL reaches you wherever you are headquartered, your existing banner was built for a different regime, and none of it is visible until the site is live. Here is the whole list, and a scan that tells you where your store stands today.
Saudi PDPL vs GDPR vs UAE law, side by side
PDPL is close to GDPR in structure, so your GDPR programme is a good starting point, but not enough on its own: Saudi Arabia has one regulator, SDAIA, with a five-day response window, its own regulation for transfers abroad, a different sensitive-data list with a criminal track, and no separate cookie law, because PDPL itself governs the personal data cookies collect.
Reviewed by Taha Farhane, Founder, Arqam360Last reviewed
| Topic | Saudi PDPL | GDPR (EU and UK) | UAE federal law (Decree-Law 45/2021) |
|---|---|---|---|
| Who it applies to | Processing in the Kingdom, and processing of the personal data of people residing in the Kingdom by a party outside it. | Organisations established in the EU, and those outside it that offer goods or services to, or monitor, people in the EU (Art. 3). | Organisations in the UAE that process personal data, and organisations abroad that process the data of people in the UAE. Free zones with their own data protection law, such as the DIFC and ADGM, are excluded (Art. 2(2)(g)). |
| Regulator | One: the Saudi Data and AI Authority (SDAIA). Five days to respond once formally notified of an alleged violation. | A data protection authority in each member state; the ICO for UK GDPR. | The UAE Data Office. The DIFC and ADGM each have their own Commissioner of Data Protection. |
| Legal basis | Consent by default, with other bases the law lists. Since the 2023 amendment, a controller’s legitimate interest is allowed, but never for sensitive data. | Six bases, none ranked above the others, including legitimate interests (Art. 6). | Consent by default: processing without consent is prohibited unless one of a closed list of exceptions applies (Art. 4). There is no legitimate-interest basis. |
| Cookies | No cookie-specific law. A cookie that can identify a visitor collects personal data, so analytics and advertising tags normally need consent first. | A separate rule: the ePrivacy Directive (Art. 5(3)), and PECR in the UK, require consent for non-essential cookies, with narrow exemptions. | No cookie-specific rule. A cookie that can identify a visitor collects personal data, so analytics and advertising tags normally need consent first. In the DIFC, Regulation 9 covers cookies directly. |
| Proof of consent | Document consent so it can be verified later, for example in registers of data subjects’ consent (Implementing Regulation, Art. 11). | The controller must be able to demonstrate consent (Art. 7(1)). | The controller must be able to prove the data subject's consent (Art. 6(1)(a)). |
| Answering data requests | 30 days, extendable once by up to 30 more if you say why in advance. | One month, extendable by two more for complex or numerous requests (Art. 12(3)). | The law sets no deadline; it is left to the executive regulations, unpublished as of September 2026. |
| Breach notification | To SDAIA within 72 hours of becoming aware, and to the people affected without undue delay. | To the authority within 72 hours where feasible, unless the breach is unlikely to create a risk (Art. 33). | To the Data Office and the people affected, within a period the executive regulations will set (Art. 9). The law sets no hour limit. |
| Data protection officer | Required in three cases: large-scale processing by a public entity, regular and systematic monitoring as a core activity, or core activities based on sensitive data (Implementing Regulation, Art. 32). | Required for public authorities, large-scale regular and systematic monitoring, or large-scale special-category data (Art. 37). | Required for high-risk processing, systematic and comprehensive assessment of sensitive data including profiling, or large volumes of sensitive data (Art. 10). The officer may be inside or outside the UAE. |
| Transfers abroad | Article 29 and the Regulation on Personal Data Transfer outside the Kingdom: an adequate level of protection or appropriate safeguards, within set exceptions. Analytics and ad platforms abroad count. | Chapter V: adequacy decisions, standard contractual clauses or binding corporate rules. | To countries with an adequate level of protection, and otherwise under the conditions the law sets, such as contractual safeguards or the data subject's express consent. |
| Maximum penalties | Administrative fines up to SAR 5,000,000, doubled for a repeat violation; up to two years’ imprisonment and SAR 3,000,000 for disclosing sensitive data with intent to harm or for gain. | Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)). | Not set in the law: Article 26 leaves violations and administrative penalties to a Cabinet decision, unpublished as of September 2026. The DIFC and ADGM fine under their own laws. |
Saudi cells restate the law and its Implementing Regulation as our Saudi PDPL guide cites them; EU cells cite GDPR articles; UAE cells cite Federal Decree-Law No. 45 of 2021 on the official UAE legislation portal (it does not apply in the DIFC or ADGM). This comparison is not legal advice.
The enforcement record — sourced, not speculative
Announced via the Saudi Press Agency, January 2026. The advisory era is over.
Source: Clyde & CoDoubled to SAR 10M for repeat offences; criminal exposure for sensitive-data disclosure.
Source: A&O ShearmanProceedings are electronic with strict deadlines. Marketing without consent is among the most-cited violations — retail is a named sector.
Source: IAPPWhy your current CMP doesn’t cover this
If you’re GDPR-compliant, you’ve done the hard part once. The Saudi market asks you to do three things your existing stack wasn’t built for.
Your EU CMP speaks the wrong language
Of the major consent platforms, none is Arabic-first. Where "PDPL support" exists, it is a translated landing page bolted onto a GDPR product — the banner your Saudi visitors see is an afterthought. Arqam360 is built Arabic-first: native RTL, bilingual cookie descriptions, and a consent record your auditor can read in either language.
PDPL is not GDPR with a different name
PDPL applies extraterritorially to any company processing Saudi residents’ data — the same reach that made GDPR global. But its consent basis, controller registration expectations, and SDAIA’s committee process differ from what your GDPR tooling assumes. Arqam360 detects the visitor’s regime automatically and serves the right consent model for each.
Your platforms may be different here
Saudi business sites run on WordPress and custom builds, and online stores on Salla and Zid alongside Shopify — platforms most EU consent tools have no app for. Arqam360 installs on any site with one script tag and has apps for Zid, Shopify and WordPress, with one dashboard (in English) covering every site you operate.
What your GDPR setup doesn’t cover under PDPL
The two laws are close in structure, and a GDPR programme is a good starting point. Four differences are where the assumption that it is enough breaks.
- One regulator, with its own process
- GDPR is enforced by a data protection authority in each EU country. PDPL has one: SDAIA. Once it formally notifies you of an alleged violation, you have five days to respond, so consent records and a processing inventory need to exist before that letter arrives.
- Transfers are checked under Saudi rules
- Sending data out of the Kingdom follows the Saudi Regulation on Personal Data Transfer outside the Kingdom, not EU adequacy decisions. A transfer your GDPR programme already covers has to be checked again against it: an adequate level of protection in the destination, or appropriate safeguards, within the exceptions the regulation sets.
- A different sensitive-data list, and a criminal track
- PDPL’s sensitive categories include credit data and data showing that a person’s parents are unknown, which GDPR’s list does not. And disclosing sensitive data with intent to harm or for personal gain can bring up to two years’ imprisonment and a fine of up to SAR 3,000,000, a criminal penalty GDPR itself does not have. Everyday tracking without consent falls under the administrative fines, up to SAR 5,000,000.
- Consent has to be informed in Arabic
- The consent rules will look familiar: specific, informed, withdrawable at any time. What changes is who is reading. A banner and a cookie declaration a Saudi visitor cannot read do not inform them, so the Arabic version is where your existing setup is most likely to fall short.
Checklist: launching a website in Saudi Arabia or the UAE from the EU or UK
Eight steps, in the order a team usually meets them. Most of your GDPR work carries over; these are the parts that change.
- 1.
Map which law covers which visitor
Saudi PDPL covers the personal data of people residing in Saudi Arabia, wherever your company is based. In the UAE, the federal Decree-Law 45 of 2021 applies, except to companies in free zones with their own data protection law, such as the DIFC and ADGM. Your EU and UK visitors stay under GDPR and UK GDPR.
- 2.
Show the banner in Arabic, right to left
A consent request the visitor cannot read does not inform them. Show the banner, the preferences panel and the cookie declaration in Arabic, laid out right to left, with English alongside.
- 3.
Ask before analytics and advertising tags run
Load non-essential tags only after consent, and make refusing as easy as accepting. In the DIFC, Regulation 9 asks for colour-neutral buttons that neither promote nor discourage a choice.
- 4.
Keep proof of every consent
Saudi Arabia's Implementing Regulation expects consent to be documented so it can be verified (Article 11), and the UAE federal law says the controller must be able to prove consent (Article 6). Store each choice with its date, time and categories, and be able to export it.
- 5.
Send Google Consent Mode v2 for every visitor
Google has required the four Consent Mode v2 signals for visitors from the European Economic Area since March 2024. Send them for Gulf visitors too, so Google knows what each visitor agreed to.
- 6.
Publish the privacy notice in Arabic
Explain what you collect, why, and how visitors exercise their rights, in Arabic as well as English.
- 7.
Check transfers out of Saudi Arabia
Sending Saudi personal data abroad, including to your head office, is checked under the Saudi Regulation on Personal Data Transfer outside the Kingdom, not under EU adequacy decisions.
- 8.
Be ready to answer SDAIA within five days
Once SDAIA formally notifies you of an alleged violation, you have five days to respond. Have the consent records and a list of your processing activities ready before that.
One banner, both regimes, every storefront
Arqam360 serves a bilingual (Arabic/English) consent banner that applies PDPL rules to your Saudi visitors and GDPR rules to your European ones — automatically, by visitor location. Consent records, cookie declarations, and DSAR handling are audit-ready in both languages. Your team manages everything from one English dashboard, whether the store runs on Shopify, Salla, Zid, or WordPress.
For companies that want compliance handled rather than managed, the Managed plan includes onboarding, configuration, and a concierge channel — your team asks, we implement.
Questions about PDPL and GDPR
- Is Saudi PDPL the same as GDPR?
- No. They are close in structure, so a GDPR programme is a good starting point, but PDPL has one regulator (SDAIA) with a five-day response window, its own transfer regulation, a different sensitive-data list, a criminal track for sensitive-data disclosure, and no separate cookie law.
- Does PDPL apply to a company outside Saudi Arabia?
- Yes, when it processes the personal data of people residing in the Kingdom. A UK or EU company whose website collects data from Saudi visitors, through forms, analytics or advertising tags, falls within it.
- Is my GDPR cookie banner enough for Saudi visitors?
- The mechanics carry over: ask before non-essential tags run, by purpose, and keep a record. What usually falls short is language. A banner a Saudi visitor cannot read does not inform them, so the Arabic version is where an EU setup most often needs work.
- How fast must I answer a data request under PDPL and under GDPR?
- Under PDPL, within 30 days, extendable once by up to 30 more with notice. Under GDPR, within one month, extendable by two more for complex or numerous requests.
- Does GDPR apply to my Saudi or UAE company?
- Only if you offer goods or services to people in the EU or monitor their behaviour there, for example with analytics or advertising tags on EU visitors. Then you may also need an EU representative under Article 27. Our guide for companies expanding to Europe covers it.