If SDAIA asks,
you have five days to answer.
The clock starts when you are formally notified of an alleged violation — not when you start looking into it. Most organisations could not describe what their own website collects in five weeks.
The scan reads your live site and needs no account. Nothing is installed.
Four things you would have to be able to show
Not what the law says in the abstract — what a response would actually have to contain.
- 1Which trackers ran before the visitor consented — and on which pages
- 2What legal basis you relied on, for each purpose separately
- 3A record of who consented to what, when, and what they were shown
- 4Evidence that a withdrawal actually stopped the processing
Three named violation categories are things a website does
The categories SDAIA names sound like policy problems. Most of them are tag problems.
An analytics or advertising tag that fires before the visitor has answered the banner. The data is collected first and permission is asked afterwards, which is the wrong order.
Visitor data forwarded to an ad platform with no record of what was sent, no way to stop it for one person, and no control that survives someone changing the theme.
A pixel building a remarketing audience out of visitors who declined. They said no, and the platform was told about them anyway.
The enforcement record — sourced, not speculative
The clock starts at notification of an alleged violation, not when you begin looking into it.
Source: Clyde & CoConfirmed by SDAIA in its 2026 announcement. Retail was named among the affected sectors.
Source: Clyde & CoDoubling to SAR 10M for a repeat violation.
Source: ProfectusEnforcement has been live since 14 September 2024. There is no transition left to rely on.
Source: Latham & WatkinsFind out before someone else asks
The scan reads your live site and reports which trackers run before consent, what they send, and where it goes. It takes under a minute, needs no account, and installs nothing. If you would rather walk through it with someone, book the review instead.