Do I need a data protection officer in Saudi Arabia?

Only in three cases set by the PDPL Implementing Regulation (Article 32): when a public entity processes personal data at large scale, when your core activities require regular and systematic monitoring of people, or when they rest on sensitive data. An employee or an outside contractor can fill the role.

Most online stores and business websites fall outside those three cases. They still need what every controller needs: a record of processing that SDAIA can ask for (purposes, who the data is about, who receives it, transfers abroad, retention periods), and an impact assessment when they process sensitive data, link datasets from different sources or monitor people constantly.