Can I use legitimate interest under the Saudi PDPL?

In some cases. The amended PDPL allows processing for the controller's legitimate interest, but never for sensitive data. Consent remains the default legal basis, though, and for analytics and advertising tags on a website the basis is normally the visitor's explicit, informed consent, not legitimate interest.

Legitimate interest came with the amendment. Royal Decree M/148 of March 2023 changed the law before it came into force, and the amended text SDAIA publishes is the version that allows it. Guides written from the 2021 text can be out of date on this, and on penalties.

Sensitive data under the PDPL covers racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric and genetic data used to identify a person; health data; and data showing that one or both of a person’s parents are unknown.