Selling into Saudi Arabia?
PDPL is already enforcing.
Saudi Arabia’s Personal Data Protection Law reaches any company processing Saudi residents’ data — wherever you’re headquartered. The regulator’s first enforcement year is over, and the numbers below are why your counsel has been sending memos.
The enforcement record — sourced, not speculative
Announced via the Saudi Press Agency, January 2026. The advisory era is over.
Source: Clyde & CoDoubled to SAR 10M for repeat offences; criminal exposure for sensitive-data disclosure.
Source: A&O ShearmanProceedings are electronic with strict deadlines. Marketing without consent is among the most-cited violations — retail is a named sector.
Source: IAPPWhy your current CMP doesn’t cover this
If you’re GDPR-compliant, you’ve done the hard part once. The Saudi market asks you to do three things your existing stack wasn’t built for.
Your EU CMP speaks the wrong language
Of the major consent platforms, none is Arabic-first. Where "PDPL support" exists, it is a translated landing page bolted onto a GDPR product — the banner your Saudi visitors see is an afterthought. Arqam360 is built Arabic-first: native RTL, bilingual cookie descriptions, and a consent record your auditor can read in either language.
PDPL is not GDPR with a different name
PDPL applies extraterritorially to any company processing Saudi residents’ data — the same reach that made GDPR global. But its consent basis, controller registration expectations, and SDAIA’s committee process differ from what your GDPR tooling assumes. Arqam360 detects the visitor’s regime automatically and serves the right consent model for each.
Your storefront stack is different here
Saudi commerce runs on Salla and Zid alongside Shopify and WordPress — platforms your current CMP has never heard of. Arqam360 is native on all four, with one dashboard (in English) covering every storefront you operate.
One banner, both regimes, every storefront
Arqam360 serves a bilingual (Arabic/English) consent banner that applies PDPL rules to your Saudi visitors and GDPR rules to your European ones — automatically, by visitor location. Consent records, cookie declarations, and DSAR handling are audit-ready in both languages. Your team manages everything from one English dashboard, whether the store runs on Shopify, Salla, Zid, or WordPress.
For companies that want compliance handled rather than managed, the Managed plan includes onboarding, configuration, and a concierge channel — your team asks, we implement.