What counts as valid consent under the Saudi PDPL?

Consent given separately for each purpose, after that purpose is explained, and documented so it can be verified later, with the time and the means (Implementing Regulation, Article 11). It can be withdrawn at any time, and it cannot be made a condition of a service unless the service depends on that processing.

For a website, the record should show when the visitor chose, what they were shown, which categories they accepted or refused, and every later change or withdrawal, kept alongside the original choice rather than overwriting it.

Consent is the PDPL’s default legal basis. For analytics and advertising tags it is normally explicit, informed consent, asked for before those tags run.