Saudi and UAE privacy law questions, answered
Each answer is short, comes first, and cites the law it relies on. The full detail lives in our regulation guides.
Saudi Arabia (PDPL)
Full guideDoes the Saudi PDPL require cookie consent?Not by name: Saudi Arabia has no law written specifically for cookies. But when a cookie or tracker can identify a visitor, what it collects is personal data under the PDPL, and analytics and advertising tags normally need the visitor's explicit, informed consent before they run. Cookies a site needs simply to work are a different case.Can I use Google Analytics in Saudi Arabia without consent?Normally not. Google Analytics sets cookies that identify a visitor's browser, so under the PDPL what it collects is personal data, and analytics normally needs the visitor's explicit, informed consent before it runs. Google Consent Mode v2 is how Google's tags learn the visitor's choice. Analytics data processed outside the Kingdom also counts as a transfer.What are the fines under the Saudi PDPL?Administrative fines of up to SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation. Separately, disclosing sensitive personal data with intent to harm or for personal gain carries up to two years in prison and a fine of up to SAR 3,000,000. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.What are the Saudi PDPL implementing regulations?They are the rules that put the Personal Data Protection Law into practice: the Implementing Regulation, which details consent, data subject rights, breach notification and the data protection officer, and the Transfer Regulation for data leaving the Kingdom. SDAIA publishes both, with the law, as PDF files in Arabic and English on its laws and regulations page.Do I need a data protection officer in Saudi Arabia?Only in three cases set by the PDPL Implementing Regulation (Article 32): when a public entity processes personal data at large scale, when your core activities require regular and systematic monitoring of people, or when they rest on sensitive data. An employee or an outside contractor can fill the role.
United Arab Emirates (federal PDPL)
Full guideIs a cookie banner mandatory in the UAE?The UAE PDPL, Federal Decree-Law No. 45 of 2021, has no provision written for cookies. But a cookie or tracker that can identify a visitor collects personal data, and processing personal data needs consent unless one of the law's exceptions applies. For analytics and advertising tags, a banner that asks first is the practical way to have that basis.Does the UAE PDPL apply to my website?It applies if your organisation is in the UAE and processes personal data, or if you are outside the UAE and process the personal data of people inside it, for example through analytics on your site. Companies established in the DIFC or ADGM follow those free zones’ own data protection laws instead.