Saudi PDPLنظام حماية البيانات الشخصية PDPL

It is supervised by the Saudi Data and AI Authority, known as SDAIA (سدايا). It applies to any organisation processing the data of people inside the Kingdom, whether that organisation is Saudi or foreign with no office here at all. The test is where the person is, not where the company is.

Why should I care about Saudi law when my company is outside the Kingdom?

A common and expensive misunderstanding. People assume the law follows the company's location. It follows the person's location.

If any of your customers are inside Saudi Arabia, the law applies to you even if your servers are in Ireland, your team is in Cairo and your company is registered in Dubai. The test is that the data belongs to someone here, not that the processing happens here.

This is not a Saudi peculiarity. It has become the global norm, in Europe and in most modern regimes. The reason is obvious: if the test were where the server sits, every company would move its servers to a country with no rules and that would be the end of it.

The practical consequence is that you may be subject to several regimes at once. A Saudi app serving residents, travellers and users across the Gulf and Europe sits under more than one umbrella, and has to meet the strictest of them at every point where they differ.

The dates that matter

The law was issued by Royal Decree M/19 on 9 Safar 1443, which is 16 September 2021. It was then amended by Royal Decree M/148 in 2023. It came into force on 14 September 2023, and organisations were given a one-year grace period that ended on 14 September 2024. Full enforcement has applied since that date.

That last date is the one that matters in practice. Everything written about the law before September 2024 was describing a deadline; everything after it describes an obligation.

The same ideas in Saudi dress

If you have read the privacy principles topic, the same six ideas are here unchanged: a lawful basis for processing, a minimum of data collected, a stated purpose, a retention period, rights for the person, and security protecting what you gathered. The differences are in the detail, not the principle.

Three details are worth knowing because they set Saudi Arabia apart:

• Consent is the default basis for processing. That is narrower than Europe, which gives "legitimate interests" much more room.
• Sensitive data gets heightened protection, and it covers ethnic origin, religious belief, health data, credit data and biometrics.
• Transferring data outside the Kingdom is restricted, and needs a documented risk assessment and approved safeguards.

One note aimed at people in FinTech: credit data is sensitive by the text of the law. Any lending or instalment company is handling sensitive data from its first day, not once it scales.

The consent trap

Because consent is the default basis, it is also where most mistakes are made. Consent that counts is explicit, tied to a stated purpose, freely given, and withdrawable at any time.

Four common practices break one of those conditions: the pre-ticked box, one consent covering ten purposes bundled into a single line, making a service conditional on a consent the service does not need, and hiding withdrawal somewhere nobody finds it. If signing up to your app collects consent for marketing in the same breath as consent to process the payment, one problem has produced two.

The fix is technical, simple and dull: record every consent with its purpose, its timestamp, and the exact wording the user agreed to. The question "what did this person consent to, and on what date" gets asked at the moment the answer is needed immediately.

Three obligations technical teams forget

The first is registration. A controller registers itself on the National Data Governance Platform. It is an administrative step with nothing to do with the quality of your code, and it is the first thing you will be asked about.

The second is a data protection impact assessment. Before any high-risk processing, a written assessment is prepared. In financial services this is the rule rather than the exception.

The third is appointing a data protection officer where the criteria apply to you. That is a named person with named responsibility, not a shared mailbox.

What a person can ask you for

Someone can find out what you hold about them, get a copy of it, ask you to correct it, and ask you to destroy it once there is no longer a reason to keep it. Withdrawing consent is also a right, and it stops the processing that was built on it.

The technical consequence of these rights is that you need to know where one person's data lives. That is easy in a single system and hard when the data is spread across a database, an analytics warehouse, your logs, three backups and a marketing vendor. Anyone building today can plan for it. Anyone who inherited an old system pays for it twice.

Seventy-two hours

If personal data leaks, is damaged, or is accessed unlawfully, you notify SDAIA within seventy-two hours of becoming aware of the incident. That deadline comes from Article 24 of the Implementing Regulations, not from the law itself.

There is no severity threshold. It is not for you to decide that a leak was small and stay quiet. Notifications are submitted through the National Data Governance Platform at dgp.sdaia.gov.sa.

You also notify the person themselves where the leak would harm their data or affect their rights or interests.

Penalties

Article 35 provides for imprisonment of up to two years and a fine of up to three million riyals, or either of them, for anyone who discloses or publishes sensitive data in breach of the law with intent to harm the person or to gain a personal benefit. That is a criminal penalty against an individual, not an administrative fine against a company.

Other violations carry a warning or a fine of up to five million riyals, which may be doubled for a repeat offence.

By early 2026 SDAIA had issued dozens of enforcement decisions against organisations in breach. This is not a sleeping text.

Financial services carry an extra layer

This law does not replace sector rules. The Saudi Central Bank imposes its own data protection and information security requirements on financial institutions, and they operate on top of the law rather than instead of it. If you work at a Saudi FinTech you are under both, and where they differ you follow the stricter one.