Saudi PDPL: Complete Guide to the Personal Data Protection Law

Any processing of personal data of individuals residing in Saudi Arabia, by entities inside the Kingdom or, extraterritorially, by entities outside it processing residents' data. It covers companies, public entities, and deceased persons' data where it could identify them or their family. There is no small-business exemption. Foreign companies serving Saudi customers online, e-commerce, SaaS, apps, are in scope and were expected to comply when the grace period closed in September 2024.

Consent remains the default, and it must be freely given, specific, and documented, with explicit consent needed for sensitive data. The M/148 amendments added the bases that made the law workable: actual or legitimate interest of the controller for non-sensitive data (with a balancing requirement and SDAIA guidance), performance of an agreement with the data subject, compliance with another law, and public or vital interest grounds. Marketing generally requires consent, and sensitive data can never rest on legitimate interest.

Five: (1) privacy notices meeting the regulations' content list before or at collection; (2) records of processing activities, with registration on SDAIA's National Data Governance Platform for controllers meeting the criteria; (3) breach notification to SDAIA within 72 hours of awareness where harm is possible, and to data subjects without undue delay where serious; (4) DPO appointment where the regulations' triggers are met (public bodies, core large-scale processing, sensitive data at scale); (5) DPIAs for high-risk processing. Data subject rights (access, correction, deletion, portability) run on 30-day clocks under the regulations.

Under the amended Article 29 and the Transfer Regulations (2023, amended 2024), transfers are allowed to countries SDAIA deems to have adequate protection, or with safeguards: SDAIA-form standard contractual clauses, binding common rules for groups, or certification, plus narrow derogations (contract necessity, the data subject's vital interest). A transfer risk assessment is required in defined cases. The regime landed close to GDPR Chapter V, but the clauses and assessments are Saudi instruments, EU SCCs are not a substitute. See the dedicated Saudi transfers and localization guide for sector rules stacking on top.

Administrative fines up to SAR 5 million (about USD 1.3 million) per violation, doubling for repeats, plus warnings and corrective orders; the public prosecution handles the criminal track, up to 2 years' imprisonment and SAR 3 million for unlawful disclosure of sensitive data, and confiscation is available. SDAIA's early posture has emphasized registration, guidance, and compliance campaigns over headline fines, consistent with a young regulator building its docket, but the criminal provisions and the closed grace period mean the downside is real, particularly for health and financial data.