PDPL Compliance Guide for Saudi Arabia

What the PDPL is

The Personal Data Protection Law (PDPL), enacted by Royal Decree M/19, is Saudi Arabia's first comprehensive data protection framework. It came into effect on September 14, 2023, with a transition period allowing organizations time to achieve full compliance. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority overseeing implementation, though supervisory functions may eventually transfer to a dedicated Personal Data Protection Authority.

For European companies operating in the Kingdom through an LLC, branch, or RHQ, PDPL compliance is not optional. Any entity processing personal data within Saudi Arabia, or processing data relating to Saudi residents, falls within scope.

Who it applies to

• Any entity or individual processing personal data within Saudi Arabia, regardless of where the entity is incorporated
• Any entity processing personal data of individuals residing in Saudi Arabia, even if processing occurs outside the Kingdom
• Government bodies processing personal data (with certain exemptions for national security and judicial functions)

Key definitions

Legal bases for processing

Consent is a primary legal basis under the PDPL but it is not the only one. The law recognizes several grounds for lawful processing:

• Consent: must be informed, specific, unambiguous, and freely given. For sensitive data, consent must be explicit.
• Contractual necessity: processing required to perform a contract with the data subject
• Legal obligation: processing necessary for compliance with Saudi law
• Vital interests: processing necessary to protect the life or health of the data subject
• Legitimate interest: recognized under the implementing regulations, subject to a balancing test (this basis is narrower than under the GDPR)
• Publicly available data: processing data that the data subject has deliberately made public

Data subject rights

The PDPL grants individuals the following rights, which organizations must be prepared to fulfill:

• Right to be informed: about what data is collected, why, and how it will be used
• Right of access: to obtain a copy of their personal data
• Right to correction: to request rectification of inaccurate data
• Right to destruction: to request deletion of personal data when no longer needed for its original purpose
• Right to withdraw consent: at any time, without affecting lawfulness of prior processing
• Right to data portability: in certain circumstances
• Right to object: to processing in specific situations

Organizations must respond to data subject requests within the timeframes specified in the implementing regulations. Having a documented process for handling these requests before they arrive is essential.

Cross-border data transfers

The PDPL restricts the transfer of personal data outside Saudi Arabia. Transfers are permitted only when:

• The receiving country provides an adequate level of data protection (SDAIA maintains or will maintain a list of adequate jurisdictions)
• Adequate safeguards are in place (contractual clauses, binding corporate rules, or other approved mechanisms)
• The transfer is necessary for specific purposes defined in the law (contract performance, legal claims, public interest)

Certain categories of data may be subject to additional data localization requirements under sector-specific regulations, particularly in financial services (SAMA rules) and telecommunications.

Data breach notification

The PDPL requires data controllers to notify SDAIA of personal data breaches that may cause harm to data subjects. Key obligations:

• Notification to SDAIA must be made within the timeframe specified in the implementing regulations
• Affected data subjects must also be notified if the breach is likely to cause significant harm
• Notifications must include: nature of the breach, categories of data affected, estimated number of individuals affected, potential consequences, and remedial measures taken
• Organizations should maintain an internal breach register documenting all incidents, whether or not they trigger notification obligations

Penalties

The PDPL establishes penalties for non-compliance, including:

• Fines of up to SAR 5 million for violations (the implementing regulations may specify different amounts for different types of violations; verify the current schedule)
• Imprisonment for certain offenses, particularly those involving disclosure of sensitive data with intent to harm
• Warning notices and corrective orders for less severe violations
• Penalties may be doubled for repeat offenses

Sector-specific overlaps

The PDPL operates alongside, rather than replacing, sector-specific data rules:

• SAMA (Saudi Central Bank): additional requirements for financial data, including data localization rules for banking and insurance
• NCA (National Cybersecurity Authority): cybersecurity controls that complement PDPL's security requirements
• CITC (Communications, Space and Technology Commission): telecommunications data rules
• NPHIES/NCAR: health data regulations for the healthcare sector

Where sector rules impose stricter requirements than the PDPL, the stricter standard applies.

Compliance steps for foreign companies

1. Data mapping. Identify what personal data you collect, where it is stored, who accesses it, and where it flows (including cross-border transfers to parent entities).
2. Legal basis assessment. For each processing activity, document the applicable legal basis under the PDPL.
3. Privacy notice. Publish a clear, Arabic-language privacy notice that meets PDPL disclosure requirements. An English version should supplement but not replace the Arabic version.
4. Consent mechanisms. Where consent is the legal basis, implement mechanisms that capture informed, specific, and unambiguous consent. Review existing consent flows inherited from European operations.
5. Data subject rights procedures. Establish internal processes for receiving, verifying, and responding to data subject requests within regulatory timeframes.
6. Cross-border transfer assessment. Audit all data flows outside Saudi Arabia and ensure each transfer has a lawful basis under the PDPL.
7. Breach response plan. Develop an incident response plan that includes PDPL notification requirements alongside any existing GDPR breach procedures.
8. Data protection officer. Assess whether your organization is required to appoint a DPO under the implementing regulations. Even where not strictly required, designating a responsible individual is prudent.
9. Vendor and processor contracts. Review agreements with third-party processors to ensure they include PDPL-compliant data processing terms.
10. Training. Ensure staff handling personal data understand PDPL obligations, particularly those who may be accustomed only to GDPR frameworks.

PDPL vs. GDPR at a glance

GDPR compliance provides a strong foundation but does not substitute for PDPL-specific compliance. The differences in cross-border transfer rules, consent requirements, and enforcement mechanisms are material.

What foreign operators get wrong

Frequently asked questions

Does the PDPL apply if my company only processes employee data?

Yes. Employee data is personal data under the PDPL. All processing of employee information, including collection during recruitment, storage during employment, and transfers to parent entities abroad, must comply with the law.

Do I need a data protection officer?

The implementing regulations specify circumstances under which a DPO appointment is required, generally related to the scale and sensitivity of data processing. Even where not mandatory, designating an individual responsible for data protection compliance is strongly recommended.

Can I transfer personal data to our European headquarters?

Cross-border transfers require either that the receiving country is on SDAIA's adequacy list or that adequate safeguards are in place. Implement appropriate contractual protections and document your transfer impact assessment before initiating routine data flows.

Is there a registration requirement with SDAIA?

The implementing regulations address registration and notification obligations. Check the current requirements with SDAIA, as these may evolve as the regulatory framework matures.

What is the current compliance deadline?

The PDPL came into effect in September 2023 with a transition period that has been extended. Verify the current deadline directly with SDAIA, as it is subject to change. Regardless of the deadline, organizations should be actively working toward compliance now.