Who enforces the Saudi PDPL?

The Saudi Data and AI Authority (SDAIA) supervises the PDPL, and SDAIA's committees can issue a warning or a fine of up to SAR 5,000,000, doubling for a repeat violation. The criminal penalty for disclosing sensitive data goes through the Public Prosecution and the courts. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.

Once formally notified of an alleged violation, an organisation has five days to respond. The violation categories SDAIA named include processing personal data without a valid legal basis, unauthorised disclosure, inadequate safeguards, and marketing sent without consent.

SDAIA is also the authority to notify within 72 hours of a breach that could harm the data or the people it belongs to, and it publishes the law and its regulations on its laws and regulations page.