Saudi PDPL Compliance Guide

The Personal Data Protection Law (PDPL) is Saudi Arabia's comprehensive data privacy regulation, enacted by Royal Decree M/19 on September 14, 2021, with enforcement beginning in September 2023. The PDPL establishes a legal framework governing the collection, processing, storage, and transfer of personal data for individuals residing in Saudi Arabia. Enforced by the Saudi Data and AI Authority (SDAIA), the law applies to all organizations — public and private, domestic and foreign — that process personal data of individuals in the Kingdom. The PDPL defines personal data broadly to include any data that can identify an individual directly or indirectly, including name, identification numbers, addresses, phone numbers, photos, and digital identifiers. Sensitive personal data receives enhanced protection and includes health data, genetic data, biometric data, ethnic origin, religious beliefs, criminal records, and financial information. Organizations must obtain explicit and informed consent before processing personal data, unless a legal exception applies. Data subjects have the right to access their personal data, request correction of inaccurate data, request deletion, withdraw consent at any time, and be informed about the purpose and legal basis for data processing. Cross-border transfers are restricted and require adequate protections. The law mandates data protection impact assessments for high-risk processing activities, appointment of data protection officers for certain organizations, and data breach notification to SDAIA within 72 hours. Penalties for non-compliance include fines up to SAR 5,000,000, with possible imprisonment for serious violations including unauthorized disclosure of sensitive data.