PDPL — Saudi Arabia’s Personal Data Protection Law Explained (2026 Guide)

TL;DR

PDPL is Saudi Arabia’s national personal data protection law that took effect on 14 September 2023 and sets rules for how organizations collect, use, store, and share personal data.
It applies broadly, including to foreign companies processing data of people in Saudi Arabia, and emphasizes lawful, purpose-limited, and minimized processing with strong security and transparency.
Individuals gain rights to access, correct, delete, withdraw consent, and request portability, and controllers must respond promptly (typically within 30 days).
Cross-border transfers are allowed but require documented safeguards, and controllers stay accountable for processors and vendors.
Enforcement is serious: fines can reach SAR 5M, with criminal penalties for unlawful handling of sensitive data, so businesses should prioritize PDPL alignment now.

What Is PDPL?

The Saudi PDPL is the national law regulating personal data handling. Promulgated by Royal Decree in September 2021, it took effect on 14 September 2023, with a mandatory compliance deadline in one year (by 14 Sept 2024). Its purpose is to protect individuals’ privacy by imposing rules on how organizations collect, use, store, and share personal data. The PDPL covers personal data (any information related to an identifiable person) and sensitive personal data (special categories like health, genetic, biometric, religious, sexual orientation, etc.), which require stricter safeguards. The law applies broadly to “controllers” (entities deciding the purpose of processing) and “processors” handling data on their behalf, in both public and private sectors. In effect, PDPL establishes legal grounds for processing (primarily consent, among others), privacy policy requirements, data security obligations, data subject rights, and limits on data retention. It aligns closely with international standards (notably the EU GDPR) but is tailored to Saudi law and culture.

Who Must Comply with PDPL

Scope: Entities Inside and Outside Saudi Arabia

PDPL’s reach is broad. It applies to any entity (public or private) that processes the personal data of individuals residing in Saudi Arabia, regardless of where the entity is located. For example, a foreign e-commerce website serving Saudi customers or a multinational company processing data of Saudi employees must comply. The law explicitly includes “sensitive personal data” and even covers data of deceased individuals if it can identify them or their families. This means payroll files, customer databases, patient records, etc., all fall under PDPL if they involve Saudi individuals.

Exclusions: What PDPL Does Not Cover

PDPL is comprehensive but not absolute. It explicitly excludes purely personal or domestic processing. For example, a private individual storing family photos or a home address book for personal reasons would not trigger PDPL obligations. The law also does not apply to situations covered by other special laws (e.g., state security, criminal investigations, judicial activities), though the exact boundaries depend on implementing regulations yet to be released. Notably, PDPL does not carve out employment data or B2B marketing as separate categories. All personal data processing requires consent or another legal basis, regardless of context.

Core Principles and Obligations Under PDPL

PDPL is built on familiar data privacy and protection principles, many of which mirror the GDPR’s core tenets. Organizations acting as data controllers must embed these principles into their processing activities:

Lawful, Fair, and Transparent Processing

Personal data must be handled lawfully and fairly. Controllers need a valid legal basis (usually the data subject’s consent under PDPL, or other grounds as amended) for each processing activity, and they must inform data subjects why they collect data and how it will be used.

Purpose Limitation & Data Minimization

Data must be collected only for specified, explicit purposes and not used beyond those purposes. Likewise, only necessary data should be collected (the “data minimization” principle). Organizations should audit their data inventory to stop gathering unnecessary fields.

Data Accuracy and Retention Limitation

PDPL obligates controllers to keep personal data accurate, complete, and up to date, and to delete or anonymize data once it’s no longer needed for the original purpose. This means periodic data purges and updates are required to prevent data hoarding.

Security, Confidentiality & Accountability

Controllers (and their processors) must implement appropriate organizational, administrative, and technical safeguards to protect data. This covers measures like encryption, access controls, breach detection, and incident response plans. The principle of accountability means organizations must document their compliance (e.g., records of processing activities) and be prepared to demonstrate it to regulators.

PDPL even requires controllers to select only third-party processors that can guarantee PDPL compliance and to oversee those vendors. These requirements ensure that both internal teams and external partners handle data responsibly.

Transparency - Privacy Policies & Notice to Data Subjects

PDPL mandates proactive transparency. Entities must publish clear privacy notices before collecting any personal data. These policies must explain the purposes of collection, what data is collected, how it will be stored and processed, retention periods, and the data subject’s rights (among other details).

If data is collected directly from the individual, controllers must explicitly inform them of the legal basis for processing, whether each data field is mandatory, any third parties receiving the data, and more. In effect, individuals should never be “in the dark” about why their data is needed or how it’s handled.

A proactive compliance approach transforms a regulatory challenge into a strategic asset. When each processing operation “respects the fundamental rights of individuals while enabling the company to pursue its business objectives,” compliance becomes a competitive edge.

Rights of Data Subjects Under PDPL

PDPL grants individuals a suite of data subject rights, empowering them to control their personal information. These include:

Right to Information (Transparency)

Data subjects have the right to know who is collecting their data, why it’s being collected, how it will be used, and whether it will be shared or sold. This ties back to the mandatory privacy notices.

Right of Access, Correction, and Deletion

Individuals can request access to all personal data an organization holds about them. They can also ask for inaccuracies to be corrected or for their data to be deleted if it’s no longer needed or was collected with consent that has been withdrawn. Under PDPL, controllers must respond to these subject access requests within 30 days, providing the data or making corrections.

Right to Withdraw Consent

Consent under PDPL is freely given but revocable. Data subjects may withdraw their consent at any time, forcing the controller to cease processing (unless another legal ground applies). Importantly, consent cannot be a precondition for providing a service unless it directly relates to that service. Controllers must inform data subjects of this right (e.g., “You can withdraw consent at any time” in the privacy notice).

Rights Related to Sensitive Data

While PDPL does not carve out new “rights” unique to sensitive personal data, it does treat sensitive data more strictly. Disclosing or processing sensitive data without authorization can trigger severe penalties (see Penalties section).

Data subjects also have a general “right to limit processing” for special cases, although PDPL did not explicitly codify this right. It is, however, recognized in official FAQs. This means, for example, that a person can object to unnecessary profiling or ask a controller to suspend certain types of data use, subject to regulatory guidance.

Cross-Border Data Transfers & Third-Party Processing under PDPL

When Transfers Are Allowed — and What Safeguards Are Required

PDPL permits cross-border data transfers only when they are necessary, lawful, and properly protected. Organizations must document a valid legal basis, assess risks in the recipient country, and apply safeguards such as contractual protections, encryption, and access controls. Records of transfer decisions should be maintained to demonstrate compliance with SDAIA.

Role of Processors, Controllers, and Third Parties

Controllers remain fully accountable under PDPL and must ensure processors and third parties follow documented instructions, implement security measures, and report breaches promptly. Processors cannot reuse or transfer data without authorization. Effective vendor risk management is essential to reduce compliance and security risks.

PDPL Compliance Timeline & Enforcement

When PDPL Became Effective & Grace Period

The PDPL was published in the Official Gazette in September 2021, but its effective date was set to 14 September 2023. The Saudi Data & AI Authority (SDAIA) immediately allowed a one-year grace period, so organizations had until 14 September 2024 to fully comply. During this year, PDPL provisions were not yet strictly enforced, giving businesses time to prepare policies, systems, and training. (Notably, foreign entities had up to five years under earlier drafts, but the new amendments targeted global firms with Saudis’ data to ensure fairly prompt compliance.)

Supervisory Authority and Regulatory Oversight

Saudi Data & Artificial Intelligence Authority (SDAIA) is the designated regulator for PDPL. SDAIA has broad powers to supervise implementation: it can request compliance documents, conduct inspections, and eventually enforce penalties. Officially, SDAIA will oversee PDPL enforcement for the first two years before potentially handing over to a new National Data Management Office (NDMO). Organizations should treat SDAIA as the point of contact for any reporting or queries.

Penalties & Consequences for Non-Compliance

PDPL violations carry serious penalties. For most breaches (failure to follow principles, processing without consent, etc.), PDPL authorizes a warning or a fine up to SAR 5,000,000 (≈USD 1.33M). Repeat offenses can double the fine. Publishing or disclosing sensitive personal data unlawfully is especially harsh: it can result in fines up to SAR 3,000,000 and/or up to 2 years in prison.

Both organizations and responsible individuals (e.g., directors) can be held liable for sensitive data breaches. Note that after amendments, criminal sanctions were mostly limited to sensitive data offenses; other violations incur only fines or warnings.

In addition to legal penalties, non-compliance risks reputational damage, loss of customer trust, and exclusion from government contracts. The lesson: PDPL compliance is mandatory, and breaches are costly.

Key Compliance Steps & Best Practices for Organizations

Organizations subject to PDPL should adopt a structured compliance program. Key steps include:

Data Inventory & Mapping: Start with a comprehensive audit of what personal data you hold, where it comes from, why you collect it, where and how it’s stored, and who you share it with.
Purpose & Policy Alignment: Based on the inventory, review whether each data processing activity is lawful and necessary. Update (or create) a clear privacy policy that specifies data collection purposes, categories of data, retention periods, and legal basis. Publish this policy on your website and ensure it’s presented to users before data collection. This transparency lets users exercise their rights and prevents “purpose creep.
Minimize and Secure Data: Limit data collection to the strict minimum needed for each purpose. Use techniques like data masking or anonymization where appropriate. Implement robust technical controls: encrypt data at rest and in transit, enforce access controls, and regularly test security.
Implement Data Subject Rights Procedures: Establish internal workflows for handling access, correction, deletion, and portability requests. Train staff (HR, customer service, IT) to recognize and escalate any such requests. Remember: responses must be given within 30 days, and requests themselves must be logged (document the request and how you fulfilled it).
Breach Response Plan: PDPL Saudi Arabia requires notification to SDAIA within 72 hours of becoming aware of a data breach. Set up an incident response plan that includes rapid detection, forensic analysis, and a notification procedure. Prepare a breach notice template that includes required details (nature of breach, affected data, steps taken) for both the authority and data subjects if their data is at risk. Quick, transparent action is critical to meet PDPL’s requirements and mitigate impact.
Governance & Training: Assign or hire a data protection officer (DPO) or equivalent (as the law prescribes) to oversee compliance. Conduct regular training and awareness programs so employees understand PDPL principles and their roles.
Cross-Border & Transfer Mechanisms: If you transfer data out of Saudi Arabia, check that the recipient countries have adequate protection or that you meet one of the PDPL’s legal conditions for transfer. Draft standard contractual clauses or binding agreements in line with PDPL requirements.

How PDPL Compares to GDPR (and Other Global Privacy Laws)

With PDPL rooted in international norms, there are notable similarities to the EU GDPR and other privacy frameworks.

Both PDPL and GDPR emphasize core principles like lawfulness, purpose limitation, data minimization, security, and accountability.

They grant similar data subject rights (access, correction, deletion, portability) and require transparency through privacy notices. Both regimes also impose strict penalties for breaches and demand data breach notifications.

However, there are key differences. For example,

The GDPR explicitly provides a “right to restrict processing” and “right to object, whereas PDPL does not explicitly grant these in the text (though the authority has indicated similar protections via guidance). Originally, PDPL had no “legitimate interests” legal basis, but a 2023 amendment added it (notwithstanding sensitive data) to bring the law closer to GDPR-style grounds.
Another difference is transfer rules: GDPR allows transfers under several mechanisms (adequacy, SCCs, etc.), while PDPL’s updated rules currently permit transfers only for certain purposes with SDAIA oversight. PDPL also has a registration requirement and local representative rules that may differ from GDPR.
In terms of penalties, GDPR’s fines can reach 4% of global turnover, while PDPL’s top fines are fixed (SAR 5M) plus potential jail for sensitive breaches.

For international companies, these differences underscore the need for a unified compliance strategy. Adopting a single privacy governance framework that addresses all applicable laws (GDPR, PDPL, CCPA, etc.) is often more efficient than siloed efforts.

Conclusion: PDPL Compliance as a Strategic Opportunity, Not a Burden

People often think PDPL is just about avoiding fines. However, at DPO Consulting, we believe it’s a chance to strengthen your organization’s data governance and reputation.

By respecting privacy rights and securing data, companies build customer trust and competitive trust. A robust PDPL compliance program can improve data quality, reduce breaches, and unlock new digital business opportunities in Saudi Arabia. Remember: data compliance goes hand-in-hand with innovation and business value.

For organizations navigating this new regulation, expert help can make a difference. DPO Consulting’s multi-regulatory compliance services specialize in aligning international data privacy laws, including PDPL, into one coherent program. Whether you need a privacy audit, policy templates, training, or an outsourced DPO, there are resources to guide you. The transition to PDPL compliance can be smooth with the right partners and a proactive approach.

Get in touch with our experts to know more about how we can help you!

FAQ

Does PDPL apply to non-Saudi companies processing Saudi residents’ data?

Yes. PDPL has an extraterritorial scope. It explicitly covers any public or private organization (even if outside Saudi Arabia) that processes personal data of individuals in Saudi Arabia. Foreign businesses serving Saudi customers or employing Saudi nationals must therefore comply with PDPL. (An earlier draft allowed a five-year delay for overseas firms, but in practice, all processors of Saudis’ data are expected to align by the compliance deadline.)

What counts as “sensitive data” under PDPL?

“Sensitive personal data” under PDPL includes categories like health information, genetic or biometric data, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sexual orientation, and criminal records. In short, any data revealing intimate aspects of a person’s identity is sensitive.

Can consent be withdrawn, and what happens then?

Yes. PDPL states that individuals may withdraw their consent to data processing at any time. When consent is withdrawn, the controller must stop processing that person’s data (unless there’s another legal justification, such as a contractual obligation or vital interest). Practically, this means organizations should implement easy ways for users to withdraw consent (e.g., an “unsubscribe” link or a data control panel) and have processes to delete or stop using the data promptly once consent is revoked.

Is anonymized or pseudonymized data still covered by PDPL?

Fully anonymized data (irreversibly de-identified so individuals cannot be identified) falls outside PDPL, as it is not “personal data.” However, pseudonymized data (where identifiers are replaced with codes but could be re-linked) is still treated as personal data under PDPL. In general, if there is any reasonable way to re-identify the person, the data are protected by PDPL, and all rules apply.

What are the reporting obligations in case of a breach?

PDPL requires prompt notification. Controllers must inform the Saudi regulator (SDAIA) “no later than 72 hours” after becoming aware of a personal data breach. The notification must include details of the breach and mitigation steps. Additionally, if the breach poses a high risk to data subjects, the controller must inform the affected individuals without undue delay. It’s best practice to have a breach-response plan ready well before any incident.

DPO Consulting: Your Partner in AI and GDPR Compliance

Investing in GDPR compliance efforts can weigh heavily on large corporations as well as smaller to medium-sized enterprises (SMEs). Turning to an external resource or support can relieve the burden of an internal audit on businesses across the board and alleviate the strain on company finances, technological capabilities, and expertise.

External auditors and expert partners like DPO Consulting are well-positioned to help organizations effectively tackle the complex nature of GDPR audits. These trained professionals act as an extension of your team, helping to streamline audit processes, identify areas of improvement, implement necessary changes, and secure compliance with GDPR.

Entrusting the right partner provides the advantage of impartiality and adherence to industry standards and unlocks a wealth of resources such as industry-specific insights, resulting in unbiased assessments and compliance success. Working with DPO Consulting translates to valuable time saved and takes away the burden from in-house staff, while considerably reducing company costs.