PDPL KSA - Saudi Arabia's Personal Data Protection Law - is in full enforcement. Since 14 September 2024, PDPL has been fully enforceable. It applies to personal-data processing in the Kingdom and also to processing by parties outside the Kingdom when it relates to individuals residing in the Kingdom, subject to the law’s exceptions. In 2026, SDAIA moved beyond the grace period and is actively auditing businesses. For organizations in Saudi Arabia and foreign entities processing personal data related to individuals residing in the Kingdom, PDPL KSA compliance is now a legal obligation with serious financial and operational consequences.
What this guide covers:
- What PDPL KSA is and when it came into force
- Who must comply - Saudi businesses, foreign companies, SMEs
- Key requirements - consent, DPO, breach notification, data transfers
- 2026 enforcement updates and what SDAIA is doing
- Penalties - fines up to SAR 5M
- PDPL KSA vs GDPR - key differences
- Step-by-step compliance checklist
What Is PDPL KSA?
PDPL KSA stands for the Personal Data Protection Law of the Kingdom of Saudi Arabia. It is the Kingdom's first comprehensive data privacy legislation.
| Detail | Information |
| Full name | Personal Data Protection Law (PDPL) |
| Enacted | Royal Decree No. M/19 - 16 September 2021 |
| Amended | Royal Decree No. M/148 - 27 March 2023 |
| Came into force | 14 September 2023 |
| Full enforcement | 14 September 2024 (end of grace period) |
| Enforced by | SDAIA - Saudi Data and Artificial Intelligence Authority |
| Penalties | Up to SAR 5,000,000 per violation |
The law was developed as part of Saudi Vision 2030's digital transformation strategy - recognizing that a modern data economy requires strong legal protection for individual privacy. PDPL KSA regulates how personal data is collected, processed, stored, shared, and deleted across both public and private sectors.
Who Must Comply with PDPL KSA?
PDPL KSA has broad scope. Compliance is not limited to large enterprises or specific industries. The following organizations must comply:
- Saudi businesses of all sizes that collect or process personal data - including contact information, employee records, customer databases, payment data, or website analytics
- Foreign companies processing personal data of individuals residing in Saudi Arabia - even without a physical presence in the Kingdom
- International SaaS platforms, ecommerce sites, and cloud services serving Saudi customers
- SMEs and startups - if you collect customer emails, manage employee records, or process payments, PDPL KSA applies
Industries with highest compliance pressure:
- Healthcare: patient records, sensitive medical data
- Financial services: customer financial and identity data
- Ecommerce and retail: customer accounts, payment data
- Technology and SaaS: user data, behavioral data
- Logistics and supply chain: employee and customer data
The law makes no exception based on company size. If you process personal data related to individuals residing in the Kingdom, PDPL may apply.
The law excludes personal-data processing by an individual for personal or family use, provided the data subject has not published or disclosed the data to others.
Key PDPL KSA Requirements
PDPL KSA establishes the following core PDPL requirements for businesses that every entity processing personal data in Saudi Arabia must follow:
1. Consent
- Consent must be clear, informed, specific, and documented
- Pre-ticked boxes and bundled consent do not meet PDPL standards
- Users must be able to withdraw consent easily at any time
- Records of consent must be maintained
- Consent is a core lawful basis under PDPL, but it is not the only one.
- Processing may also be permitted under Article 6, such as contractual necessity, legal obligation, actual interests of the data subject, or legitimate interest subject to PDPL limits.
2. Data Minimization
- Only collect data necessary for a defined and legitimate purpose
- Avoid collecting excessive or irrelevant information
- Review data regularly and delete what is no longer needed
3. Data Protection Officer (DPO)
- Mandatory for organizations processing personal data on a large scale
- Mandatory for organizations handling sensitive data categories
- DPO must have direct access to leadership and adequate resources
- Responsible for compliance oversight, SDAIA liaison, and data subject requests. Organizations that cannot appoint a full-time DPO can explore DPO-as-a-Service Saudi Arabia as a cost-effective alternative.
A DPO is required where Article 32 criteria are met, including certain public entities processing personal data on a large scale, controllers whose core activities require regular and systematic monitoring of data subjects, and controllers whose core activities are based on processing sensitive personal data.
4. Breach Notification
- Notify SDAIA within 72 hours of discovering a personal data breach
- If serious harm is likely - notify affected individuals as well
- Must have a documented breach response plan before an incident occurs
5. Cross-Border Data Transfers
- Transferring personal data outside Saudi Arabia requires SDAIA approval or safeguards
- Organizations must use standard contractual clauses or ensure recipient country has adequate protection
- This affects businesses using international cloud platforms, overseas support teams, or global SaaS tools. A cybersecurity risk assessment Saudi Arabia can help identify where personal data leaves your systems and what safeguards are needed.
- Remote access to personal data stored abroad is treated as a data export under PDPL Article 29
6. Data Subject Rights
| Right | What it means |
| Right to be informed | Individuals must know how their data is used |
| Right to request copy | Individuals can request a copy of their data |
| Right to request Access | Individuals can view the personal data an organization holds about them, either through a request or through access methods provided by the controller. |
| Right to correction | Individuals can request updates to inaccurate data |
| Right to deletion | Individuals can request data be destroyed in certain cases |
| Right to withdraw consent | Individuals can withdraw consent at any time |
7. Records of Processing Activities (RoPA)
- Must document all personal data processing activities
- Must include: what data is collected, why, how long retained, who it is shared with
- Must be available to SDAIA on request
- Must be kept updated as processing activities change
PDPL KSA Enforcement in 2026 - What Has Changed
2026 marks a significant shift. SDAIA has moved from guidance and awareness to active enforcement.
Key enforcement fact: As of January 2026, SDAIA announced 48 formal enforcement decisions had been issued. Businesses across healthcare, finance, and ecommerce have received formal notifications, investigations, and indictments.
How SDAIA enforcement works:
Independent multi-disciplinary committees with technical and legal expertise conduct all enforcement actions
- Committees can summon organizations, request documents, and access confidential records
- External technical experts can be appointed during investigations
- All proceedings are managed through an electronic platform
Failure to respond within prescribed timeframes is formally recorded and worsens your position
What triggers an enforcement action:
- Data breach reports filed with SDAIA
- Complaints submitted by individuals
- Failure to respond to data subject requests
- Proactive audits based on sector risk profiles
- Non-cooperation during previous investigations
2026 lesson: SDAIA is evaluating businesses on operational readiness - not just whether policies exist on paper. Organizations must demonstrate how data flows through their systems, who has access, how long it is retained, and what controls protect it.
PDPL KSA Penalties
Non-compliance with PDPL KSA carries serious consequences across financial, operational, and reputational dimensions.
| Penalty type | Detail |
| Maximum financial fine | SAR 5,000,000 per violation |
| Repeat violations | Court may double the fine |
| Operational impact | Suspension of data processing activities |
| Business impact | Business suspension in severe cases |
| Reputational impact | Formal enforcement record affecting investor and partner trust |
| IPO / M&A risk | Non-compliance creates legal exposure affecting valuation |
PDPL KSA vs GDPR - Key Differences
Many international organizations are already familiar with GDPR. While PDPL KSA shares many principles, important differences require separate attention.
| Aspect | PDPL KSA vs GDPR |
| Core principles | Both require lawful processing, consent, data subject rights, breach notification |
| Cross-border transfers | PDPL KSA is stricter - requires SDAIA approval or explicit safeguards |
| Deceased data | PDPL KSA covers data of deceased individuals in some cases - GDPR does not |
| Enforcement structure | PDPL KSA uses SDAIA committees - GDPR uses national supervisory authorities |
| If already GDPR compliant | A separate PDPL KSA gap assessment is still required |
Being GDPR compliant does NOT automatically mean PDPL KSA compliant. A separate review is required for KSA-specific requirements - especially cross-border transfer rules.
PDPL KSA Compliance Checklist - Step by Step
Use this checklist to assess your current compliance status and identify what needs to be fixed.
- Step 1: Data Mapping - identify all personal data collected, where it comes from, where it goes, and who has access
- Step 2: Legal Basis - for every processing activity, document the lawful basis (consent, contractual necessity, legal obligation)
- Step 3: Privacy Policy Update - rewrite in plain language covering what data is collected, why, how long retained, and individual rights
- Step 4: DPO Appointment - assess if required and formally assign the role with adequate access and resources
- Step 5: Vendor Contracts - review all supplier and third-party agreements to include PDPL-compliant data processing terms
- Step 6: Breach Response Plan - document detection, containment, assessment, and 72-hour SDAIA notification procedures
- Step 7: Staff Training - train all employees who handle personal data on PDPL obligations, breach recognition, and data subject requests
- Step 8: RoPA - create and maintain Records of Processing Activities covering all data categories, legal bases, retention periods, and sharing
How CyberRT Helps with PDPL KSA Compliance
CyberRT provides cybersecurity and compliance services specifically designed for businesses operating in Saudi Arabia. Our PDPL support covers both technical and operational requirements.
- PDPL gap assessment - review of data handling practices, security controls, vendor relationships, and documentation against PDPL KSA requirements
- DPO-as-a-Service - qualified data protection officer support without the cost of a full-time hire
- Technical security controls - NCA ECC and SAMA Cyber Framework aligned safeguards required under PDPL Article 19
- Security awareness training - PDPL-specific training to reduce human-driven compliance risks
- Breach response planning - documented procedures for detection, containment, and 72-hour SDAIA notification
Frequently Asked Questions
Q1: What are the penalties for PDPL KSA non-compliance?
Penalties can reach SAR 5,000,000 per violation. Repeat violations can be doubled by the court. Organizations also risk operational restrictions, business suspension, and serious reputational damage.
Q2: Does PDPL KSA apply to foreign companies?
Yes. If a foreign company processes personal data of Saudi residents - through a website, app, or cloud service - it must comply with PDPL KSA regardless of where it is based.
Q3: What is the difference between PDPL KSA and GDPR?
Both laws require consent, data subject rights, and breach notification. The key difference is that PDPL KSA imposes stricter cross-border transfer restrictions and requires SDAIA approval for data leaving Saudi Arabia. Being GDPR compliant does not mean being PDPL compliant.
Q5: What is the 72-hour rule under PDPL KSA?
Organizations must notify SDAIA within 72 hours of discovering a data breach that poses a risk to individuals. If serious harm is likely, affected individuals must also be notified directly.
Q6: Does PDPL KSA apply to small businesses?
Yes. PDPL KSA applies to all businesses regardless of size. If a small business collects customer emails, processes payments, or stores employee records, it must comply with the law.
