PDPL for Law Firms in Saudi Arabia: Protecting Client Data in Practice

PDPL for law firms in Saudi Arabia means treating every client file as regulated personal data: having a lawful basis for each use, collecting only what a matter needs, protecting sensitive data such as criminal and health records, keeping a record of processing, answering data subject requests, controlling transfers abroad and reporting serious breaches to SDAIA within 72 hours.

The Personal Data Protection Law has been in force since 14 September 2023, with a one-year grace period that ended on 14 September 2024. It applies to law firms like any controller, but legal files raise the stakes. This guide turns the law's main duties into practice-management decisions. For the general framework, start with our PDPL compliance guide; the official texts are published on SDAIA's National Data Governance Platform.

Why are law firms high-risk controllers under the PDPL?

A firm processes data about far more people than its clients: opposing parties, witnesses, experts, heirs, employees of corporate clients and its own staff. Much of it comes from third parties, and a large share is sensitive.

Article 1 of the PDPL defines sensitive data as personal data relating to racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric data that identifies a person; genetic data; health data; and data indicating that one or both of a person's parents are unknown. In legal practice they map onto real files:

• Criminal defence and investigations hold security and criminal data.
• Medical malpractice, insurance and workplace injury claims hold health data.
• Personal status and inheritance matters can reveal religious and family information, sometimes including that a parent is unknown.
• Identity checks that use fingerprints or facial images involve biometric data.

Sensitive data cannot be processed on the basis of legitimate interest, and it should drive the strictest access rules in the firm.

What lawful basis does a law firm rely on?

Article 5 makes consent the default: personal data may not be processed, or used for a new purpose, without the individual's consent, except where the law provides otherwise. Article 6 lists the exceptions. Three matter most to a private firm:

• A prior agreement. Processing that performs an agreement to which the data subject is a party, such as the engagement with your client.
• Another law. Processing required under another law in force in the Kingdom.
• Legitimate interest. Processing necessary for the firm's legitimate interests, provided it does not prejudice the individual's rights or interests and never for sensitive data. Article 16 of the Implementing Regulations requires a documented assessment before relying on it.

For opposing parties and witnesses, Article 10 says data should be collected directly from the individual, then lists cases where it may be collected from others, including consent, publicly available sources and legitimate interest (again, not for sensitive data). Some exceptions, such as processing to meet judicial requirements, are written for public entities, so a private firm should not assume they cover it. Record which basis you rely on for each category of data and each purpose.

How does data minimisation apply to client files?

Article 19 of the Implementing Regulations requires controllers to collect, and to keep, only the minimum data needed for the purpose. For a firm that means intake forms that ask only what the matter requires and no "just in case" copies of everything a client sends.

Identity documents deserve their own rule. Article 31 tells controllers not to photocopy or copy official identity documents issued by public entities unless a competent public entity requests it or a law requires it, to protect any copies they do hold, and to destroy them as soon as the purpose ends unless a legal requirement says otherwise. Check whether a law actually requires ID copies at each step.

What should a law firm's record of processing activities contain?

Article 33 of the Implementing Regulations requires a written record of processing activities, kept for as long as processing continues plus five years after it ends, kept accurate and current, and made available to SDAIA on request. Its minimum contents include purposes, data and data subject categories, retention periods, recipients, transfers abroad and security measures. A typical law firm record includes:

Processing activity	Data subjects	Typical data	Question to settle
Intake and conflict checks	Prospective clients, opposing parties	Names, ID numbers, company details, matter summary	What is the minimum needed to clear a conflict?
Litigation and advisory files	Clients, opponents, witnesses, experts	Contracts, correspondence, evidence, sometimes criminal or health data	Which matters hold sensitive data, and who may open them?
Powers of attorney and court references	Clients, lawyers	Power of attorney numbers, scope, end dates, Najiz case numbers	How long are they kept after closure?
Billing and collections	Clients, payers	Fee agreements, invoices, bank details	Which tax and accounting rules set retention?
HR and recruitment	Staff, candidates	Contracts, payroll, qualifications	Is access separate from client files?
Marketing and newsletters	Contacts	Names, emails	Is there consent and an easy opt-out?

For court references, see our guide to running a law office around Najiz.

What rights do clients and other individuals have?

Article 4 gives data subjects the right to be informed, to access their data, to obtain a copy in a readable format, to request correction and to request destruction; Article 5 adds the right to withdraw consent. Article 3 of the Implementing Regulations requires controllers to act on requests within 30 days, extendable by up to 30 more days where a request needs unusual effort or the same person sends several, provided the person is told in advance with reasons. The firm must verify the requester's identity and keep a record of every request, including oral ones.

Legal files complicate this. The PDPL tells a controller not to grant access where, among other cases, it would violate another individual's privacy or affect criminal proceedings or an accused person's right to a fair trial (Articles 9 and 16), and not to disclose data where that would breach legally established professional obligations. These limits are narrow. Route every request through one person, log the decision and take legal advice before refusing.

How long can a law firm keep client data?

Article 18 requires destruction without delay once the purpose of collection ends, with two exceptions that matter in legal practice. Where a legal basis requires retention for a specified period, data is kept and then destroyed when that period or the purpose ends, whichever is later. Data closely connected to a case pending before a judicial authority is kept for that purpose and destroyed once the judicial procedures are complete.

Article 8 of the Implementing Regulations adds that destruction covers all copies, including backups, and that the controller should ask the parties it disclosed the data to to destroy it as well. A retention schedule per matter type, with closure dates that generate destruction tasks, is the practical answer.

When can client data leave Saudi Arabia?

Article 29 of the PDPL permits transferring personal data outside the Kingdom, or disclosing it to a party abroad, for listed purposes, including performing an obligation to which the data subject is a party and other purposes set by the regulations. The transfer must not prejudice national security or the Kingdom's vital interests, the destination must offer a level of protection no lower than the PDPL's, and only the minimum data needed may be sent. The Regulations on Personal Data Transfer outside the Kingdom set the detailed routes.

In law firms, transfers hide in everyday tools: email hosted abroad, overseas cloud storage, e-signature, translation and AI drafting services, and files shared with foreign co-counsel. SDAIA's guide for controllers and processors notes that data hosted abroad, remains subject to the PDPL. Map these flows and add them to your record of processing.

What must a firm do after a data breach?

Article 24 of the Implementing Regulations requires the controller to notify SDAIA within 72 hours of becoming aware of a personal data breach if the incident could harm the data or the individuals, or conflict with their rights or interests. The notice describes the incident, the people and data affected, the risks, the measures taken and a contact person. Anything not available within 72 hours follows as soon as possible with reasons for the delay. Affected individuals must be told without undue delay, in plain language, where the breach may harm them, and copies of reports and corrective actions must be kept. These duties sit alongside any NCA reporting obligations.

Typical law firm incidents are a misdirected email with a bundle attached, a lost laptop or a compromised mailbox. A one-page playbook should name who decides, who notifies SDAIA and who speaks to clients.

What access controls and audit logs does a law firm need?

Article 23 of the Implementing Regulations requires organisational, administrative and technical security measures, and compliance with NCA controls or, where the firm is not bound by them, recognised cybersecurity best practice. Our NCA ECC guide outlines that baseline. In a law office it translates into:

• Matter-level permissions so only the team on a matter can open its files, with information barriers between conflicting matters.
• Multi-factor authentication on email, document storage and the practice system.
• Audit logs that record who viewed, downloaded, shared or deleted each document, reviewed on a schedule.
• Encryption on laptops, phones and backups, and external sharing links that expire.

These controls are far easier to enforce in structured law firm software than in shared folders.

How should a law firm choose vendors and cloud providers?

Article 8 of the PDPL requires a controller to choose processors that provide the guarantees needed to comply with the law and to verify that they do; the firm stays responsible to clients and to SDAIA. Before signing with a practice management, email, cloud or AI vendor, ask:

• Where is the data stored and processed, including backups and support access?
• Does the contract bind the vendor to the PDPL, limit use to your instructions and require breach notice fast enough for your 72-hour clock?
• Can you export and delete all your data when the contract ends?
• Which subcontractors handle the data, and where?

Hosting in Saudi data centres removes much of the cross-border analysis. Our cybersecurity and compliance service designs these architectures.

Does a law firm need a data protection officer?

Article 32 of the Implementing Regulations requires a data protection officer in three cases, including where core activities involve processing sensitive data. Firms centred on criminal, medical or personal status work should assess this; the officer can be an employee or an external contractor.

PDPL checklist for law firms

Area	Action	Evidence to keep
Data map	List matter types, data categories, systems and recipients	Record of processing activities
Lawful basis	Assign a basis to each purpose, including third-party data	Lawful basis register, legitimate interest assessments
Intake	Trim forms and stop routine ID photocopies	Approved intake template
Sensitive data	Tag matters that hold criminal, health or similar data	Matter classification
Access and logs	Matter-level permissions, MFA, information barriers, reviewed audit logs	Access and log review records
Rights requests	One intake channel with 30-day tracking	Request log and responses
Retention	Schedule per matter type, including backups	Retention schedule, destruction log
Transfers	Map tools hosted abroad and apply Article 29 conditions	Transfer register
Vendors	PDPL clauses, breach notice and exit terms	Signed processor agreements
Breaches	72-hour playbook, tested at least once a year	Playbook and exercise report

What is the next step?

Trace one active matter from intake to archive: who collected what, where it is stored, who can open it and when it will be destroyed. The gaps become your priority list. To build these controls into daily work, see our systems for law firms and book a free review.

This article is general information, not legal advice. Confirm your obligations with qualified counsel and SDAIA's official texts.