If you handle customer, employee or patient data connected to Saudi Arabia, the PDPL probably applies to you. It is the Kingdom's Personal Data Protection Law: the rulebook for how organisations collect, use, store, share and delete personal data about people in Saudi Arabia, and the source of the rights those people can enforce.
This guide covers what the law says, who it reaches, what it asks of a business and what happens when things go wrong. It also shows where Cyber RT Privacy fits into the daily work. When you are ready to act, the PDPL Saudi Arabia checklist and the step-by-step compliance guide are the natural next reads.
What is the PDPL in Saudi Arabia?
The PDPL is the Kingdom's first comprehensive data protection law. It was issued by royal decree, amended in March 2023 and is supervised by the Saudi Data and AI Authority (SDAIA). Two sets of rules sit underneath it: the Implementing Regulations, published on 7 September 2023, and the Regulation on Personal Data Transfer Outside the Kingdom.
The law came into force on 14 September 2023. Businesses then had a year to get ready, and that transition period ended on 14 September 2024. There is no grace period left to wait out.
| Item | Detail |
| Regulator | Saudi Data and AI Authority (SDAIA) |
| Amended | March 2023 |
| In force | 14 September 2023 (transition ended 14 September 2024) |
| Supporting rules | Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom |
| Time to answer individuals | 30 days, extendable by a further 30 days in limited cases |
| Breach notice to SDAIA | Within 72 hours of becoming aware, where the breach may cause harm |
| Maximum fine for most violations | Up to SAR 5 million, doubled for repeat violations |
Who has to follow it?
Almost everyone who deals with personal data in or about the Kingdom. That includes businesses based in Saudi Arabia and organisations abroad that process the personal data of individuals in Saudi Arabia. The law is not tied to one industry, so banks, hospitals, retailers, schools and software companies are all in scope. Some sectors also answer to their own regulators, which means the PDPL sits next to those rules rather than replacing them.
- Controllers decide why and how personal data is processed. They carry most of the responsibility.
- Processors handle data on a controller's behalf, such as a payroll, cloud or marketing provider. They have duties too.
- One exception: processing for purely personal or family purposes falls outside the law.
The terms you will keep running into
- Personal data: information that identifies a person, or makes them identifiable, directly or indirectly. A name, national ID number, phone number, email address or photograph all count.
- Sensitive data: the higher-risk group. It covers health, genetic, biometric, credit and location data, ethnic or tribal origin, religious, intellectual or political beliefs, and security or criminal records.
- Data subject: the person the data is about. A customer, an employee, a patient or a website visitor.
- Processing: anything you do with the data, from collecting and storing it to sharing or deleting it.
What the PDPL asks of a business
It helps to think of the duties in three moments: before you collect data, while you hold it and when something goes wrong.
Before you collect
- Have a valid basis for processing. Consent is the main one, with limited alternatives in the law and regulations. It should be clear, tied to a purpose and easy to withdraw.
- Tell people what you collect, why, how, how long you will keep it and who gets it.
- Collect only what the stated purpose needs.
While you hold it
- Keep the data accurate, protect it with suitable technical and organisational safeguards, and delete it when the purpose ends.
- Keep a Record of Processing Activities (RoPA) that shows what you process, why, where and with whom.
- Run a Data Protection Impact Assessment (DPIA) for projects that may carry a high risk to individuals.
- Check your vendors. A controller stays responsible for the processors it uses.
- Appoint a Data Protection Officer (DPO) where the Implementing Regulations require one.
When something goes wrong, or someone asks
- Answer individual requests within 30 days.
- Notify SDAIA within 72 hours of becoming aware of a breach that may cause harm, and tell affected individuals without undue delay.
The rights people have over their data
The PDPL gives individuals six practical rights. Each one needs a process behind it, because a request can arrive through a web form, an email or a shop counter.
- To be informed about how their data is collected and used
- To access the personal data you hold about them
- To obtain a copy of it
- To have inaccurate or incomplete data corrected
- To ask for it to be destroyed when the purpose has ended or the law allows
- To withdraw consent given earlier
You have 30 days to respond. A further 30 days is available where the request needs unusual effort or the same person has sent several. Our guide to data subject access requests goes deeper on how to run this.
Sending data outside the Kingdom
Plenty of Saudi businesses use cloud platforms, group companies or support teams elsewhere. Under the PDPL, personal data can leave the Kingdom only in the situations and on the conditions set out in the Transfer Regulations. A good first move is to list every vendor and system that stores or touches personal data abroad, then check each one against that regulation.
What happens if you get it wrong?
Most violations can bring a warning or a fine of up to SAR 5 million, and a repeat violation can double it. Disclosing or publishing sensitive data to harm someone, or for personal benefit, can mean up to two years in prison and/or a fine of up to SAR 3 million. Individuals can also claim compensation for damage. The full picture is in our article on penalties for PDPL non-compliance.
The PDPL next to other data protection laws
If you work in more than one market, you will meet several laws that look alike but are not identical. This content series follows these six:
- Saudi Arabia: Personal Data Protection Law (PDPL)
- Bahrain: Personal Data Protection Law (PDPL)
- UAE: Federal Personal Data Protection Law (PDPL)
- Oman: Personal Data Protection Law (PDPL)
- DIFC, UAE: Data Protection Law
- ADGM, UAE: Data Protection Regulations
This guide stays with Saudi Arabia. Cyber RT's website lists support for Saudi, Bahrain, UAE and Oman PDPL, so a team in several of those markets can run one programme instead of one per country.
Where Cyber RT Privacy fits
Cyber RT Privacy is built to take privacy work out of spreadsheets, shared inboxes and disconnected forms. Each module answers a specific question the PDPL will eventually ask you:
- Where is the data? Data Scan searches connected databases such as Oracle, SQL Server and PostgreSQL by an identifier and keeps a scan history.
- Who asked for what, and by when? Data Subject Rights (DSR) Management turns requests into tickets with owners, deadlines and closure evidence.
- Can you prove consent? Consent Management keeps a searchable register with timestamps, purposes and withdrawals.
- Can you trust your vendors? Vendor Management covers assessments, approvals and processing agreements.
- What do you process, and why? The RoPA module lets each department keep its own records, with DPO oversight.
- Is this new project risky? DPIA and PIA workflows guide the assessment and keep the decisions on record.
- What happens when there is an incident? Data Breach Management takes it from triage to closure with an evidence repository.
- Can you show it to an auditor? Reports produces dashboards and PDF evidence packs.
Mistakes worth avoiding early
- Leaving the PDPL to the legal team alone. HR, IT, Sales, Finance and Customer Support all hold personal data.
- Not knowing where personal data lives, which makes every request slow.
- Running rights requests from a shared inbox with no deadline tracking.
- Scattering consent records across tools, so proof takes days to assemble.
- Forgetting vendors, even though you are still answerable for them.
A sensible order of work
- Decide whether you are a controller, a processor or both.
- Find out where personal data sits across systems and vendors.
- Review privacy notices and how you collect consent.
- Set up one process for individual requests.
- Assess vendors and any transfers outside the Kingdom.
- Write a breach plan that fits the 72-hour window.
Want to see the platform rather than read about it? Watch the demo or request a session and the Cyber RT team will walk you through it.
Frequently asked questions
What is the PDPL in Saudi Arabia?
It is Saudi Arabia's Personal Data Protection Law. It controls how organisations collect, use, store, share and delete personal data about individuals in the Kingdom, and it gives those individuals rights over their data.
Who regulates the PDPL?
The Saudi Data and AI Authority (SDAIA). It supervises the law and published the Implementing Regulations and the Transfer Regulations.
When did the PDPL start to apply?
The law came into force on 14 September 2023. A one-year transition period followed and ended on 14 September 2024.
Does a company outside Saudi Arabia need to comply?
Yes, if it processes the personal data of individuals in the Kingdom.
Is employee data covered?
Yes. Employee records are personal data like any other, so HR systems fall under the law.
What is the difference between personal data and sensitive data?
Personal data is anything that identifies a person or makes them identifiable. Sensitive data is a narrower group, including health, genetic, biometric, credit and location data, beliefs, ethnic origin and criminal or security records, and it gets stronger protection.
Is consent always required?
Consent is the main basis for processing, but the law and its Implementing Regulations allow other bases in limited cases. Check the basis for each purpose before relying on it.
How quickly must we answer an individual's request?
Within 30 days, with a possible extra 30 days where the request needs unusual effort or the same person has sent several.
What is the penalty for breaking the PDPL?
Most violations can lead to a warning or a fine of up to SAR 5 million. Disclosing sensitive data with intent to harm or for personal benefit can lead to up to two years in prison and/or SAR 3 million. Read more in our guide to PDPL penalties.
Where can I find a PDPL task list?
Our PDPL Saudi Arabia checklist breaks the law into twelve areas, each with practical tasks.
How does Cyber RT help with the PDPL?
Cyber RT Privacy combines Data Scan, DSR Management, Consent Management, Vendor Management, RoPA, DPIA, Data Breach Management and Reports in one platform, with an audit trail behind each action.
Related reading
- PDPL Saudi Arabia checklist
- Penalties for PDPL non-compliance
- How to comply with PDPL: step-by-step guide
This guide is general information, not legal advice. Check the official PDPL text and regulations published by SDAIA, or speak to qualified counsel, for your situation.
