What are the Saudi PDPL implementing regulations?

They are the rules that put the Personal Data Protection Law into practice: the Implementing Regulation, which details consent, data subject rights, breach notification and the data protection officer, and the Transfer Regulation for data leaving the Kingdom. SDAIA publishes both, with the law, as PDF files in Arabic and English on its laws and regulations page.

Read the amended text. The law was changed by Royal Decree M/148 in March 2023, before it came into force, and some guides still quote the 2021 version.

For a website, the provisions that matter most are consent for each purpose kept on record (Implementing Regulation, Article 11), answering data requests within 30 days, notifying SDAIA within 72 hours of a breach that could cause harm, and checking every transfer of data outside the Kingdom (Article 29 and the Transfer Regulation).