What is sensitive data under the Saudi PDPL?

Racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric and genetic data used to identify a person; health data; and data showing that one or both of a person's parents are unknown. Processing these carries stricter conditions, and legitimate interest can never be the basis for it.

Sensitive data changes what else applies. You need an impact assessment when you process it (Implementing Regulation, Article 25), and a data protection officer when your core activities rest on it (Article 32). Disclosing sensitive data with intent to harm or for personal gain is the one route to the criminal penalty: up to two years in prison and a fine of up to SAR 3,000,000.

Credit data is not on the list in the amended text, but it has its own rule: processing it needs explicit consent. For a website, check what your forms, orders and tags actually collect against these categories.