Does a cookie banner make my website PDPL compliant?

No, not by itself. The banner is the part of the PDPL a visitor sees: it asks before analytics and advertising tags run and records each answer. Behind it, the law expects answers to data requests within 30 days, notice to SDAIA within 72 hours of a harmful breach, a record of processing, and checks on transfers abroad.

Those duties sit outside the banner. People can ask for the legal basis and purpose, see their data, get a copy, and have it corrected or destroyed; you have 30 days, with one extension of up to 30 more if you tell them beforehand and say why. A breach that could harm the data or the people it belongs to goes to SDAIA within 72 hours, and to those people without undue delay.

Implementing the PDPL on a website takes six steps, and the banner is one of them: list the data you collect and the tags you run, publish an Arabic privacy policy, ask consent before analytics and ad tags and record it, answer data requests within 30 days, notify SDAIA within 72 hours of a breach, and check every transfer of data outside the Kingdom.