Does the Saudi PDPL apply to small businesses?

Yes. The PDPL applies to any organisation, public or private, domestic or foreign, that processes personal data of people in Saudi Arabia. Processing by an individual for purely personal or family purposes is outside it. Most small and mid-sized businesses do not need a data protection officer, but they still need someone who owns data protection.

A small online store that runs analytics or advertising tags still needs consent before they run, a way to answer data requests within 30 days, and a plan to notify SDAIA within 72 hours of a breach that could harm the data or the people it belongs to.

A data protection officer is required only in three cases (Implementing Regulation, Article 32): a public entity processing personal data at large scale, core activities that require regular and systematic monitoring of people, or core activities that rest on sensitive data.