Loading...
Personal Data Protection Law
Saudi Arabia's Personal Data Protection Law establishes comprehensive data protection requirements for all public and private sector organisations processing personal data. It mandates consent-based processing, 72-hour breach notification, cross-border transfer restrictions, and Data Protection Officer appointments, with extraterritorial reach to foreign entities processing Saudi residents' data.
30+
Articles
72h
Breach Notification
All
Sectors Covered
Sep 2024
Enforced
16 September 2021
Royal Decree M/19 issued and published
27 March 2023
Amendments adopted (Royal Decree M/148)
14 September 2023
PDPL and Implementing Regulations came into effect
14 September 2024
Compliance grace period ended — fully enforceable
Establish lawful grounds for data processing, obtain explicit consent before collection and processing except where legally permitted.
Notify SDAIA within 72 hours of becoming aware of a data breach affecting data subjects' rights or interests.
Maintain Registers of Processing Activities (RoPA) documenting all data processing operations.
Only transfer personal data outside KSA when adequate safeguards exist, subject to SDAIA approval requirements.
Appoint a Data Protection Officer to oversee PDPL compliance within the organisation.
SAR 5,000,000 (~EUR 1.2M)
Maximum administrative fine for non-compliance
SAR 3,000,000 + 2 years imprisonment
Criminal offence for unauthorised disclosure with intent to harm
Double the stated maximum
Competent court may double fines, even exceeding stated caps
We provide structured preparation and compliance support for Saudi PDPL.
Schedule a consultation with our regulatory experts to assess your Saudi PDPL compliance posture and build a practical roadmap.