What are the fines under the Saudi PDPL?

Administrative fines of up to SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation. Separately, disclosing sensitive personal data with intent to harm or for personal gain carries up to two years in prison and a fine of up to SAR 3,000,000. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.

SAR 5,000,000 is about $1.33M at the fixed rate of 3.75 riyals to the dollar. The full penalty framework has applied since 14 September 2024.

A website running analytics or advertising tags without consent faces the administrative track, not the criminal one. The violation categories SDAIA named include processing personal data without a valid legal basis, unauthorised disclosure, inadequate safeguards, and marketing sent without consent.

Once formally notified of an alleged violation, an organisation has five days to respond. That is too short to build consent records or a processing inventory from scratch, so they need to exist beforehand.