Saudi Arabia Data Privacy Laws: PDPL Compliance Guide (2026)

Saudi Arabia's Personal Data Protection Law (PDPL), enacted under Royal Decree No. M/19 and amended by Royal Decree No. M/148, governs the collection and processing of personal data for any organization handling data of individuals located in the Kingdom. Full enforcement by SDAIA commenced September 14, 2024.

Information last verified: July 23, 2026

Saudi Arabia's Personal Data Protection Law (PDPL) represents the Kingdom's first comprehensive data protection framework. Royal Decree No. M/19 enacted it on September 16, 2021; Royal Decree No. M/148 amended it on March 27, 2023. The law entered into force on September 14, 2023, and full enforcement began on September 14, 2024. Any organization that processes personal data of individuals located in the Kingdom must comply, regardless of where that organization is established.

This guide covers the PDPL's legal framework, SDAIA's enforcement role and track record, lawful bases for processing, sensitive data rules, data subject rights, controller obligations, breach notification, cross-border transfer requirements, penalties, and the most significant 2024-2026 regulatory developments.

For Saudi recording-law requirements, see our companion article on Saudi Arabia recording laws.

---

Quick Answer: What Is the Saudi Arabia Data Privacy Law?

Saudi Arabia's primary data privacy law is the Personal Data Protection Law (PDPL), enacted by Royal Decree No. M/19 on September 16, 2021, and amended by Royal Decree No. M/148 on March 27, 2023. The PDPL is enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA) through its National Data Governance Platform.

The law entered into force on September 14, 2023. Organizations were granted a one-year grace period to achieve compliance; that grace period expired on September 14, 2024, and full enforcement has been active since that date. As of early 2026, SDAIA has issued 48 enforcement decisions against organizations in violation of the PDPL.

Key features include: consent as the default lawful basis for processing; enhanced protections for sensitive personal data; a 72-hour breach notification obligation to SDAIA; data subject rights of access, correction, deletion, and portability; mandatory controller registration on SDAIA's platform; restrictions on cross-border data transfers; and penalties up to SAR 5 million for administrative violations, with criminal sanctions for intentional disclosure of sensitive data.

This article covers Saudi Arabia's data privacy law under the PDPL only. For sector-specific rules (financial services, telecommunications, healthcare), organizations should consult the relevant Saudi regulatory authority alongside the PDPL.

---

The PDPL: Legislative Framework and Regulator

The PDPL is Saudi Arabia's first general data protection statute. It draws on international frameworks, particularly the EU General Data Protection Regulation (GDPR), while incorporating provisions specific to the Kingdom's legal and national security context.

Legislative History

The PDPL's key milestones are:

• September 16, 2021: Royal Decree No. M/19 enacted the PDPL
• March 27, 2023: Royal Decree No. M/148 amended the PDPL, introducing legitimate interests as a new lawful basis and strengthening cross-border transfer rules
• September 7, 2023: SDAIA published the Implementing Regulations
• September 14, 2023: PDPL entered into force; one-year grace period began
• September 14, 2024: Grace period expired; full enforcement commenced
• February 2025: SDAIA published the Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• April 27, 2025: SDAIA opened a third public consultation on proposed amendments to the Implementing Regulations (closed May 27, 2025)
• November 2025: SDAIA published its AI Adoption Framework, creating parallel governance obligations for AI systems that process personal data
• Early 2026: SDAIA reported 48 cumulative enforcement decisions; Saudi Arabia declared 2026 the Year of AI

SDAIA: The Current Regulator

The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority for PDPL enforcement. SDAIA holds power to issue implementing regulations and supplementary guidance, investigate potential violations through formal committee-led proceedings, impose administrative fines, and refer criminal matters to the courts.

The PDPL provides that SDAIA serves as the competent authority for the first two years after the law enters into force, with the possibility of transferring oversight to the National Data Management Office (NDMO) thereafter, subject to a government assessment of the data sector's maturity. The two-year initial period ran from September 14, 2023 to approximately September 2025. As of May 2026, SDAIA continues to operate as the active regulator; no formal transfer to the NDMO has been announced. Organizations should monitor the SDAIA and National Communications Commission portals for any transition announcement.

The NDMO sits within the NCC and is responsible for national data governance policy more broadly, including the Istitlaa consultation platform through which public comments on proposed regulatory changes are submitted.

SDAIA operates the National Data Governance Platform (NDGP) as the central portal for controller registration, breach reporting, DPO appointment notifications, and regulatory communications.

Scope: Who Must Comply?

The PDPL applies to:

• Any entity or individual located within Saudi Arabia that processes personal data, regardless of the nationality of the data subjects
• Any entity or individual outside Saudi Arabia that processes personal data of individuals located in the Kingdom, even without a physical presence there

This extraterritorial reach mirrors the GDPR approach. A company headquartered in the United States, the European Union, or Asia that collects or processes data from Saudi residents through a website, mobile application, or service must comply with the PDPL.

Personal Data and Sensitive Personal Data

The PDPL defines personal data as any data that can identify an individual or make them identifiable, directly or indirectly. This includes names, national identification numbers, addresses, phone numbers, photographs, voice recordings, and any other information linked to an identifiable person.

Sensitive personal data receives heightened protection. The PDPL treats the following categories as sensitive:

• Racial or ethnic origin
• Religious, intellectual, or political beliefs
• Criminal and security records
• Biometric data (fingerprints, facial recognition, retinal scans)
• Genetic data
• Health data (medical records, conditions, treatments)
• Data revealing that one or both of an individual's parents are unknown

This last category is unique to the PDPL and does not appear in the GDPR or most comparable frameworks. Organizations processing any of the above categories face stricter obligations and higher criminal exposure than those processing ordinary personal data.

---

Lawful Bases for Processing

The PDPL establishes an opt-in consent model as the default, supplemented by additional lawful bases introduced or clarified by the 2023 amendments.

Consent

Consent is the principal lawful basis under the PDPL. The law requires that consent be:

• Explicit: the data subject must affirmatively agree; silence or inaction does not constitute consent
• Specific: each purpose must be disclosed and consented to separately
• Documented: organizations must be able to demonstrate that consent was given
• Revocable: data subjects must be able to withdraw consent at any time, and controllers must cease processing upon withdrawal (unless another lawful basis applies)

For sensitive personal data and credit data, the consent requirement is heightened: explicit consent with detailed disclosure is mandatory, and no alternative lawful basis can substitute.

Other Lawful Bases

Beyond consent, the PDPL recognizes:

• Legal or regulatory obligation: processing required to comply with a Saudi law or regulation
• Contractual necessity: processing needed to perform obligations under a contract with the data subject
• Vital interests: processing necessary to protect the health, safety, or life of the data subject or another person
• Legitimate interests: processing necessary for the controller's legitimate interests, provided those interests do not override the data subject's rights (introduced by the M/148 amendments in 2023)
• Public interest or national security: processing required for public interest or to protect national security
• Publicly available data: processing of data lawfully made publicly available by the data subject

One critical restriction: the legitimate interests basis cannot be used for sensitive personal data. This is a stricter standard than the GDPR, which permits legitimate interests for some sensitive data categories in limited circumstances.

---

Sensitive Personal Data: Enhanced Obligations

Processing sensitive personal data triggers stricter requirements than ordinary personal data at every stage of the compliance lifecycle.

Explicit consent is required in all cases; no alternative lawful basis (including legitimate interests) may be substituted. Organizations must conduct a Data Protection Impact Assessment before commencing sensitive data processing. Legitimate interest cannot justify sensitive data processing under any circumstances. Sensitive data cannot be used for marketing purposes. Additional technical and organizational security safeguards must be implemented beyond those required for ordinary personal data.

The criminal penalties for unauthorized disclosure of sensitive personal data are more severe than for general PDPL violations, and SDAIA's enforcement actions have specifically targeted organizations that processed sensitive data without a valid legal basis.

---

Data Subject Rights

The PDPL grants individuals an enforceable set of rights. SDAIA has shown willingness to act on data subject complaints, and controllers that fail to respond within the statutory timeframes have faced enforcement consequences.

Right to Be Informed

Data subjects have the right to know: the legal basis for processing; the purpose of data collection; the means by which data is collected; and the identity of any third party to whom data may be disclosed.

Right of Access

Individuals can request a complete copy of all personal data an organization holds about them, in a readable format. Controllers must respond within 30 days, with a possible 30-day extension where the volume or complexity of the request justifies it. The controller must notify the data subject of any extension and explain the reason before the initial period expires.

Right to Correction

Data subjects can request correction of inaccurate personal data. When a correction is made, the controller must notify all third parties that previously received the data so they can update their records.

Right to Deletion

Individuals can request deletion of personal data when it is no longer necessary for the purpose for which it was collected, when consent has been withdrawn, or when processing was unlawful. Exceptions apply where the data is needed for legal proceedings or regulatory compliance.

Right to Data Portability

Upon request, controllers must provide personal data in a structured, machine-readable format (such as CSV or JSON) to allow the data subject to transfer it to another controller.

Right to Withdraw Consent

Data subjects can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal. Upon withdrawal, the controller must cease processing unless another lawful basis applies.

Right to Object

Data subjects can object to processing in certain circumstances, particularly where processing is based on legitimate interests. Controllers must cease processing unless they can demonstrate compelling legitimate grounds that override the data subject's interests.

The 30-Day Response Obligation

Controllers must respond to all data subject requests within 30 days. An extension of a further 30 days is available where justified by complexity or volume, but the data subject must be notified before the initial period expires. SDAIA enforcement actions have included failure to respond to data subject complaints as a standalone violation category.

---

Controller Obligations

Organizations that determine the purpose and means of processing personal data carry the following core obligations under the PDPL and its Implementing Regulations.

Controller Registration on the NDGP

Controllers meeting any of the following criteria must register on SDAIA's National Data Governance Platform:

• Public entity
• Core activity involves processing personal data
• Transfers personal data outside the Kingdom or discloses it internationally
• Processes sensitive personal data
• Processes data about individuals who lack full or partial legal capacity

Registration is free and completed online. The registration certificate is valid for five years; SDAIA notifies controllers 30 days before expiry. Under the proposed 2025 amendments to the Implementing Regulations, the registration criteria will be further clarified and consolidated into the Implementing Regulations directly.

Privacy Notices

Controllers must provide data subjects with a privacy notice before or at the time of data collection. The notice must disclose: the identity of the controller; the purposes of processing; the lawful basis; the categories of data collected; any recipients of the data; cross-border transfer arrangements; data retention periods; and the data subject's rights and how to exercise them.

Data Protection Officer Appointment

SDAIA's Rules for Appointing a Data Protection Officer require DPO appointment where the controller:

• Is a public entity providing large-scale services involving personal data processing
• Has core activities that involve regular and systematic monitoring of data subjects on a large scale
• Has core activities that involve large-scale processing of sensitive personal data

The DPO must hold appropriate academic qualifications and experience in data protection, have knowledge of risk management, and hold no convictions for dishonesty or breach of trust. The DPO may be an employee or an external contractor. DPO contact details must be submitted to SDAIA through the NDGP and updated whenever a change occurs.

The proposed 2025 amendments would consolidate DPO requirements into the Implementing Regulations and require controllers to formally document DPO appointments.

Data Protection Impact Assessments

A DPIA is required before undertaking processing that poses heightened risk to data subjects. Mandatory DPIA scenarios include:

• Processing sensitive personal data
• Systematic, large-scale processing of individuals who lack legal capacity
• Collecting or linking data from multiple sources
• Deploying new technologies with significant privacy impact
• Automated decision-making that may cause serious harm to data subject privacy
• Providing products or services likely to cause serious harm to data subject privacy interests

The Implementing Regulations set minimum DPIA requirements, and a copy must be shared with any processor handling the relevant data.

Privacy by Design

The PDPL requires controllers to embed data protection principles into systems, processes, and products from the design stage. Technical and organizational measures must be integrated into every operational decision involving personal data; documentation alone does not satisfy this obligation.

Records of Processing Activities

Controllers must maintain records of their processing activities covering: purposes of processing; categories of data subjects and personal data; recipients; cross-border transfer arrangements; and security measures implemented. Records must be accurate and kept for a defined period, and must be produced to SDAIA on request. The proposed 2025 amendments simplify the ROPA requirements by stating the core obligations more clearly.

Security Obligations

Controllers must implement technical and organizational security measures proportionate to the risk. SDAIA's enforcement actions have specifically targeted organizations with insufficient security controls. Coordinating with Saudi Arabia's National Cybersecurity Authority (NCA) Essential Cybersecurity Controls is strongly recommended practice.

---

Breach Notification Requirements

The PDPL imposes a strict breach notification framework with no materiality threshold.

Notification to SDAIA: 72-Hour Deadline

Under Article 24 of the Implementing Regulations, controllers must notify SDAIA within 72 hours of becoming aware of a breach that may harm personal data or data subjects' rights. The 72-hour clock applies regardless of the size or apparent impact of the breach; the PDPL does not permit controllers to self-assess materiality and withhold notification.

Content of the Notification

Notifications to SDAIA must include: a description of the incident and how it occurred; the category and estimated number of affected individuals; an assessment of potential consequences; and the measures taken or planned to contain the breach and prevent recurrence.

Notification to Data Subjects

Data subjects must be notified without undue delay where a breach may cause harm to their personal data or interests. The notification must be sufficiently detailed to allow individuals to understand the risk and take protective steps.

Reporting Channel

All breach notifications must be submitted through the National Data Governance Platform. Organizations must register before they can access the breach reporting function; waiting until a breach occurs to register is not an acceptable approach.

SDAIA's Three-Stage Response Framework

SDAIA's Personal Data Breach Incidents Procedural Guide sets out a three-stage response protocol: (1) containment and initial assessment; (2) detailed investigation and risk evaluation; and (3) remediation with follow-up reporting to SDAIA.

---

Cross-Border Data Transfers

Transferring personal data outside Saudi Arabia is one of the most heavily regulated aspects of the PDPL. The cross-border transfer regime operates through the PDPL, the SDAIA Regulation on Personal Data Transfer Outside the Kingdom, and the February 2025 Risk Assessment Guideline.

General Conditions for Transfer

Controllers cannot transfer personal data outside the Kingdom unless all of the following conditions are met:

1. The transfer does not prejudice national security, the vital interests of the Kingdom, or public order
2. The recipient country provides an adequate level of data protection as determined by SDAIA
3. The transfer is limited to the minimum data necessary for the specified purpose
4. Appropriate safeguards are in place

Adequacy Assessments

SDAIA determines whether a recipient country provides equivalent protection by examining the country's data protection legal framework, whether a functioning supervisory authority exists and cooperates with Saudi regulators, and whether the recipient country's framework conflicts with Saudi law or interests. As of May 2026, SDAIA had not published a formal adequacy list comparable to the EU adequacy decisions.

Approved Safeguards for Non-Adequate Countries

For transfers to countries without an adequacy determination, controllers must implement SDAIA-approved safeguards:

• Standard Contractual Clauses (SCCs) approved by SDAIA
• Binding Corporate Rules for intra-group international transfers
• Other contractual mechanisms providing protection equivalent to the PDPL

The February 2025 Risk Assessment Guideline

SDAIA published the Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom in February 2025. While not legally binding, the guideline establishes the methodology SDAIA expects controllers to follow, organized into four phases:

Phase 1: Preparation: Identify the types of personal data to be transferred, the categories of data subjects, the frequency of transfers, and the data recipient's compliance posture.

Phase 2: Risk Assessment: Evaluate whether the transfer could compromise national security, economic stability, or public interest. Assess the technical and organizational measures the recipient has in place.

Phase 3: Safeguards Implementation: Document the safeguards (SCCs, BCRs, or other mechanisms) and confirm they are in place before the transfer begins.

Phase 4: Documentation and Review: Maintain records of the risk assessment and review them whenever circumstances change, including when recipient-country law changes or a new category of data is added to the transfer.

For continuous or large-scale transfers of sensitive personal data, a risk assessment is mandatory before the transfer begins.

Data Localization Considerations

The PDPL does not impose a general data localization requirement. However, Saudi authorities have indicated a preference for storing sensitive and personally identifiable data within the Kingdom. Sector-specific rules in financial services, telecommunications, and health may impose additional localization obligations. The National Cybersecurity Authority's requirements apply in parallel.

---

Penalties and Enforcement

Administrative Penalties

SDAIA may issue a written warning for first or minor violations. For substantive violations, SDAIA may impose a fine of up to SAR 5 million (approximately USD 1.33 million). For repeat violations, the fine doubles to a maximum of SAR 10 million (approximately USD 2.67 million).

Beyond fines, SDAIA has authority to order suspension of processing activities. Courts can also order publication of the judgment at the violator's expense, confiscation of proceeds obtained through the violation, and destruction of unlawfully collected data.

Criminal Penalties

The PDPL includes criminal sanctions. Intentional disclosure or publication of sensitive personal data with intent to harm the data subject or gain personal benefit is a criminal offense under the PDPL. Penalties for this offense include:

• Imprisonment of up to two years
• A fine of up to SAR 3 million (approximately USD 800,000)
• Or both

For repeat criminal offenses, courts may double the penalty to SAR 6 million and extended imprisonment.

The Enforcement Process: Five-Day Response Window

SDAIA investigations are conducted through a formal committee-led process with short statutory deadlines. Once an organization is notified of an alleged violation, it has only five days to submit its response and supporting evidence to SDAIA. Organizations that have not pre-identified authorized representatives, prepared valid powers of attorney, and tested access to SDAIA's electronic platforms are at a significant disadvantage when an investigation is opened.

The enforcement process operates largely through the NDGP, and SDAIA holds broad powers to obtain documents, data, and explanations from the subject of an investigation.

Enforcement Track Record: 48 Decisions Through Early 2026

As of early 2026, SDAIA's enforcement committees have issued 48 cumulative enforcement decisions against organizations found in violation of the PDPL. The primary violation categories in those decisions were:

1. Collecting or processing personal data without a valid legal basis
2. Unauthorized disclosure of personal data
3. Failure to implement adequate technical and organizational security controls
4. Sending marketing communications without prior consent

SDAIA has also acted on data subject complaints, requiring controllers to respond within short timeframes and provide supporting evidence of compliance. Enforcement activity is expected to grow as SDAIA's investigative capacity increases and Saudi residents become more aware of their PDPL rights.

---

The 2025 Proposed Amendments to the Implementing Regulations

On April 27, 2025, SDAIA opened a third public consultation on proposed amendments to the PDPL Implementing Regulations via the Istitlaa Platform. The consultation closed on May 27, 2025.

The proposed amendments respond to practical challenges organizations encountered during the first year of full enforcement. Key proposed changes include:

Controller Registration: Consolidation of the standalone Rules Governing the National Register of Controllers into the Implementing Regulations, with a clarified list of registration criteria.

Data Protection Officer: Consolidation of the standalone Rules for Appointing a DPO into the Implementing Regulations, with a requirement to formally document DPO appointment and submit DPO contact details to SDAIA's platform.

Records of Processing Activities: Simplified ROPA requirements, clarifying that records must be retained for a defined period, kept accurate and up to date, and produced to SDAIA on request.

Direct Marketing: Clarifications on consent requirements and opt-out mechanisms.

Breach Notification: Revised definitions and clarified notification procedures.

The finalized amendments had not been published as of May 2026. Organizations should monitor the SDAIA Laws and Regulations Portal for the final version.

---

Year of AI 2026 and PDPL Implications

Saudi Arabia declared 2026 its official Year of AI, signaling a government-wide commitment to accelerating AI deployment. SDAIA leads both the AI governance and data protection agendas, creating an integrated compliance environment for organizations deploying AI systems that process personal data.

In November 2025, SDAIA published its AI Adoption Framework, establishing a mandatory governance baseline covering five pillars: data governance, model accountability, transparency, human oversight, and risk management. AI systems that process personal data must satisfy both PDPL requirements and the AI Adoption Framework's governance controls simultaneously.

SDAIA's earlier Generative AI Guidelines (2024) and updated AI Ethics Principles (2025) form part of the same regulatory framework. Organizations using AI tools in Saudi Arabia must assess whether those tools process personal data of Saudi residents. If they do, PDPL consent, transparency, DPIA, and data minimization obligations apply in addition to the AI-specific governance requirements.

---

Business Compliance Checklist

Organizations subject to the PDPL should address the following:

1. Conduct a personal data inventory: Map all processing activities, identifying what data is collected, on what legal basis, and how it flows within and outside the organization
2. Document lawful bases: For each processing activity, document which PDPL lawful basis applies
3. Update privacy notices: Ensure all disclosures meet PDPL transparency requirements
4. Build opt-in consent flows: For processing relying on consent, implement mechanisms that record explicit, specific, revocable consent
5. Register on the NDGP: If any registration criterion applies, complete registration before commencing processing
6. Appoint a DPO if required: Check whether the controller meets DPO thresholds; if so, appoint and register the DPO on the NDGP
7. Conduct DPIAs: Before processing activities that pose heightened risk to data subjects
8. Establish a breach response procedure: Ensure the organization can detect, assess, and notify SDAIA within 72 hours
9. Assess cross-border transfers: Conduct documented risk assessments for all transfers outside the Kingdom; implement SCCs or other approved safeguards
10. Prepare for enforcement: Identify authorized representatives, establish powers of attorney for SDAIA proceedings, and test NDGP platform access
11. Assess AI systems: Determine whether AI tools that process personal data trigger both PDPL and AI Adoption Framework obligations
12. Train staff: Ensure all employees who handle personal data understand their PDPL obligations

---

---

Not Legal Advice: This article presents general legal information about Saudi Arabia's Personal Data Protection Law as verified in May 2026. It does not constitute legal advice and does not address all sector-specific rules that may apply to particular industries. Laws and regulations change; verify current requirements with a lawyer licensed in the relevant jurisdiction before taking action.

---

---

Authorities Cited