Personal Data Protection Law (PDPL)

· About Personal Data Protection Law (PDPL)

Key Takeaways

  • The Saudi Personal Data Protection Law (PDPL) applies to controllers that process personal data in Saudi Arabia and, in some cases, to controllers outside the Kingdom if they process personal data of individuals in Saudi Arabia by means other than personal/family activity or for service delivery to persons in the Kingdom.[7][13]
  • The PDPL became effective on 14 September 2023, followed by a one-year grace period that ended on 14 September 2024, after which the law became fully enforceable.[1][8][13]
  • SDAIA is the competent authority for the PDPL framework, and its committees review violations and issue enforcement decisions for non-compliance.[1][2][9]
  • The current implementing regulations remain the 2023 text unless and until the 2026 consultation results in final amendments; as of October 2026, the proposed 2026 amendments are still under public consultation and are not yet law.[1][5]
  • The law carries administrative sanctions, and public enforcement reporting indicates active penalties have already been imposed during 2025 and 2026.[1][10]
  • Proposed 2026 amendments may materially affect operational obligations, including registration, breach notification, and possible in-Kingdom storage requirements, but those changes are not yet effective.[1][3][4]

What It Is

The PDPL is Saudi Arabia’s core privacy statute for the collection, storage, use, disclosure, and other processing of personal data in the Kingdom.[7][13] It establishes lawful-processing rules, data-subject rights, transfer controls, security obligations, and enforcement powers for the Saudi Data and Artificial Intelligence Authority (SDAIA), which acts as the competent authority.[2][7][9]

The law was issued by Royal Decree No. M/19 dated 9/2/1443 AH (16 September 2021) and later amended by Royal Decree No. M/148 dated 5/9/1444 AH (27 March 2023).[7][13] SDAIA’s own materials state that the law came into force on 14 September 2023 and that controllers had a one-year grace period to comply, ending on 14 September 2024.[1][8][13]

The current phase in 2026 is active enforcement plus regulatory refinement. SDAIA opened public consultation on draft amendments to the implementing regulations on 6 October 2026, with consultation ending 5 November 2026; if adopted, the amended regulations would enter into force 60 days after publication.[1][3][4]

Who Must Comply

The PDPL applies to any controller processing personal data in Saudi Arabia, and it also has extraterritorial effect for controllers outside the Kingdom where processing relates to individuals in Saudi Arabia in circumstances covered by the law.[7][13] The law’s practical scope is broad and covers most private-sector and public-sector processing, subject to defined exemptions.[7][13]

The law excludes processing by individuals for personal or family use, and it also recognizes limited exemptions where disclosure is required for public interest, security, or other legally specified purposes.[7][13] The rules also include special treatment for some categories of data and special rules for transfer outside the Kingdom.[7][10]

The PDPL is not limited to large companies, and no general employee-count or revenue threshold defines scope in the way some other privacy laws do.[7][13] Instead, applicability turns on whether an entity is acting as a controller of personal data and whether a statutory exemption applies.[7][13]

Core Requirements

  1. Lawful basis and purpose limitation: Controllers must process personal data for clear, lawful, and specified purposes, and they must avoid processing beyond what those purposes justify.[7][13]
  2. Transparency and notice: Controllers must provide privacy information to data subjects, including the purposes of processing and relevant rights and disclosures.[5][7][10]
  3. Data minimization and retention control: Controllers should collect only what is necessary and retain personal data only for as long as needed for the stated purpose, subject to legal retention duties.[7][10]
  4. Security safeguards: Controllers must implement organizational and technical measures to protect personal data from unauthorized access, disclosure, alteration, or loss.[7][10]
  5. Rights handling: Controllers must support individual rights such as access, correction, and deletion where the law permits, and must maintain processes for complaints and responses.[5][7][10]
  6. Cross-border transfer controls: Transfers of personal data outside Saudi Arabia are regulated and require compliance with the PDPL transfer framework and related conditions.[7][10][13]
  7. Governance and accountability: Controllers must maintain internal controls, records, and documented policies proportionate to the processing they perform, with some obligations depending on the nature and scale of processing.[5][7][10]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | PDPL issued | 16 September 2021 | Royal Decree No. M/19 issued the PDPL.[7][13] | | Amended PDPL | 27 March 2023 | Royal Decree No. M/148 amended the statute.[7][13] | | PDPL in force | 14 September 2023 | Law became effective.[1][8][13] | | Grace period ended | 14 September 2024 | Full compliance became mandatory and enforcement became active.[1][8][13] | | Draft implementing-regulation amendments consulted | 6 October 2026 to 5 November 2026 | Proposed changes are under public consultation only.[1][3][4] |

Maximum penalties and sanctions include administrative fines and other enforcement measures under the PDPL, with SDAIA reporting active decisions against violators.[1][10][14] Public summaries identify penalties including monetary fines and, for some violations, possible publication of the decision or other administrative consequences; precise maximums depend on the violated provision and the enforcement decision.[10][14] The law is now being enforced in practice, so organizations should treat non-compliance as an active regulatory risk rather than a future one.[1][10]

How to Comply

  1. Map processing activities: Build a record of processing activities covering data categories, purposes, recipients, storage locations, transfers, and retention periods; this aligns well with ISO 27001 asset and information classification controls and NIST CSF 2.0 governance functions.[10][13]
  2. Classify data and identify special cases: Separate ordinary personal data from sensitive or higher-risk processing, then apply stricter controls to health, biometric, financial, or children’s data where applicable.[7][10]
  3. Set lawful bases and notices: Update privacy notices, HR notices, vendor-facing notices, and customer-facing notices so they explain purpose, scope, rights, and transfer practices clearly and consistently.[5][7][10]
  4. Implement security controls: Use ISO 27001-style access control, logging, encryption, vendor assurance, vulnerability management, and incident response; map these to NIST CSF 2.0 Protect and Detect outcomes.[10]
  5. Operationalize rights requests: Create a workflow for access, correction, deletion, and complaints with service levels, identity verification, and documented decision criteria.[5][7][10]
  6. Control cross-border transfers: Review all intra-group and third-country transfers, document transfer assessments, and put contractual and technical safeguards in place before moving data outside Saudi Arabia.[7][10][13]
  7. Strengthen governance: Assign accountability to privacy, legal, security, and business owners, then use ISO 42001-style management discipline to review AI-related or automated processing that uses personal data.[10]
  8. Monitor regulatory change: Track SDAIA’s consultation outcomes and any final amended implementing regulations, because 2026 drafts may materially change registration, breach reporting, and localization expectations.[1][3][4]

Related Regulations

  • Saudi Cybersecurity Controls (ECC and related standards): These overlap on security governance, incident management, and technical safeguards, but the PDPL is the primary privacy law for personal data processing.[7][10]
  • Saudi E-Commerce Law: This can overlap when personal data is processed in online sales, but PDPL governs the privacy and transfer aspects.[7][13]
  • Telecommunications and digital-content rules: These may add sector-specific privacy or consent obligations for service providers, creating layered compliance duties.[7][10]
  • GDPR: Multinational companies may need to comply with both regimes simultaneously, especially for Saudi customers who are also EU data subjects, but the legal bases, transfer rules, and rights mechanics do not match exactly.[10][13]
  • UK GDPR: It can conflict with local transfer or retention practices if one compliance program is built only around European rules, so Saudi-specific transfer and notice analysis is still required.[10][13]

FAQ

Does the Saudi PDPL apply to companies outside Saudi Arabia?

Yes, in some cases it does. The law can apply extraterritorially to controllers outside the Kingdom when they process personal data of individuals in Saudi Arabia in circumstances covered by the PDPL.[7][13] A foreign company that targets Saudi customers or handles their personal data should assume Saudi privacy obligations may apply unless a specific exemption clearly excludes the activity.[7][13]

When did the PDPL become fully enforceable?

The PDPL became effective on 14 September 2023 and then had a one-year grace period that ended on 14 September 2024.[1][8][13] Since then, SDAIA has treated the law as fully enforceable and has reported active enforcement decisions.[1][10]

Is there a new 2026 amendment to the PDPL already in force?

No. As of October 2026, the 2026 changes are still in the consultation stage, with public consultation running from 6 October 2026 to 5 November 2026.[1][3][4] Until final text is published and enters into force, the 2023 implementing regulations remain the operative framework.[1][5]

Do companies need to store personal data in Saudi Arabia?

Not under the currently operative text as of October 2026. A 2026 draft reportedly proposes an in-Kingdom storage duty, but that proposal is not yet law.[1][3][4] Organizations should treat it as a possible future requirement and assess data residency exposure now.

What happens if a company violates the PDPL?

The law provides for administrative sanctions, including fines and other consequences depending on the breach and the enforcement decision.[10][14] SDAIA has reported that its committees have already issued enforcement decisions, so violations can lead to real-world penalties rather than warning letters alone.[1][10]

Does the PDPL replace sector-specific rules?

No. It functions as the baseline privacy law, but sector-specific rules and cybersecurity controls may still apply alongside it.[7][10][13] A compliant program must reconcile the PDPL with other Saudi obligations, especially in regulated sectors and digital services.

Sources

Put it into practice

More compliance guides