PDPL Saudi Arabia: The Complete 2026 Compliance Guide to the Personal Data Protection Law

The PDPL is Saudi Arabia's Personal Data Protection Law, the Kingdom's first comprehensive data protection law. Issued by Royal Decree M/19 in 2021 and amended in 2023, it took effect on 14 September 2023 and is enforced by SDAIA. It applies to any organisation processing personal data of people in Saudi Arabia.

What is the PDPL in Saudi Arabia?

The Personal Data Protection Law (نظام حماية البيانات الشخصية) sets the rules for how public and private organisations collect, use, store, share, transfer and destroy personal data. It gives individuals enforceable rights over their data and gives the regulator power to investigate, fine and publish decisions. For most organisations it sits alongside sector rules from the Saudi Central Bank (SAMA), the Communications, Space and Technology Commission and the National Cybersecurity Authority (NCA).

The law defines personal data broadly: any information, whatever its source or form, that identifies an individual directly or indirectly. That includes names, ID numbers, addresses, phone numbers, bank and card numbers, and photos or video of a person.

Key PDPL dates and legal instruments

Date	Milestone
16 September 2021 (9/2/1443H)	PDPL issued by Royal Decree No. M/19
27 March 2023 (5/9/1444H)	PDPL amended by Royal Decree No. M/148
7 September 2023	SDAIA issues the Implementing Regulations and the Regulations on Personal Data Transfer outside the Kingdom
14 September 2023	PDPL enters into force
September 2024	One-year transition period for existing controllers ends; full enforcement
6 October to 5 November 2026	Public consultation on SDAIA's draft amendments to the Implementing Regulations

The official texts of the law, regulations and guidelines are published in the knowledge centre of SDAIA's National Data Governance Platform.

Who must comply with the PDPL?

The PDPL applies to any processing of personal data that takes place in the Kingdom, and to processing by entities outside the Kingdom of personal data relating to individuals resident in Saudi Arabia. In practice that captures:

• Saudi companies of every size, from retailers and clinics to banks and factories.
• Government entities and their affiliated companies.
• Foreign companies selling online to Saudi residents or processing their data offshore.
• Processors, such as cloud providers, call centres and software vendors, acting on behalf of a controller.

The law distinguishes the controller (جهة التحكم), which decides why and how data is processed, from the processor (جهة المعالجة), which processes data on the controller's behalf. Controllers carry primary responsibility and must periodically verify that their processors comply.

Who regulates the PDPL?

The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority. It runs the National Data Governance Platform, where controllers register, submit personal data breach notifications, carry out impact assessments and self-assessments, and where individuals file complaints. The platform also offers a tool to check whether you must appoint a data protection officer.

What rights do individuals have under the PDPL?

Article 4 of the law gives data subjects five core rights, and Article 5 adds the right to withdraw consent:

1. Right to be informed of the legal basis and purpose for collecting their data.
2. Right of access to their personal data held by the controller.
3. Right to obtain a copy of their data in a readable and clear format.
4. Right to request correction, completion or updating of their data.
5. Right to request destruction of data that is no longer needed.
6. Right to withdraw consent at any time, where processing is based on consent.

Under the Implementing Regulations, controllers must fulfil rights requests within 30 days. They may extend by up to 30 more days where a request needs unusual effort or the same person sends multiple requests, provided they tell the individual in advance and explain why. Individuals can complain to SDAIA within 90 days of the incident or of becoming aware of it.

What are the main obligations for controllers?

Lawful basis and purpose

Processing requires consent unless an exception applies, for example where processing is required by another law, performs a prior agreement with the individual, or serves the controller's legitimate interest without harming the individual's rights (legitimate interest cannot be used for sensitive data). Data may only be used for the purpose it was collected for.

Transparency and minimisation

Publish a clear privacy policy before collection, collect only the minimum data needed, keep it accurate, and destroy it when the purpose ends unless the law requires retention. SDAIA has published guidelines on privacy policies, minimum necessary data and destruction, anonymisation and tokenisation.

Sensitive data

Under the amended law, sensitive data covers racial or ethnic origin, religious, intellectual or political beliefs, security and criminal data, biometric data that identifies a person, genetic data, health data, and data indicating that a person's parents are unknown. It carries stricter conditions and the heaviest penalties.

Records, assessments and security

Controllers must keep records of processing activities, carry out a data protection impact assessment where processing is high risk, apply organisational, administrative and technical security measures, and use processors that provide sufficient guarantees. Security measures should align with NCA requirements; our NCA ECC guide explains the baseline.

How fast must a data breach be reported?

Under Article 24 of the Implementing Regulations, a controller must notify SDAIA within 72 hours of becoming aware of a personal data breach if the incident could harm the personal data or the individuals, or conflict with their rights or interests. The notification goes through the National Data Governance Platform and must describe the incident, the categories and approximate number of people affected, the risks and the measures taken. Affected individuals must be told without undue delay where the breach may cause them damage. Keep a copy of every report. SDAIA's October 2026 draft amendments propose removing the harm threshold, so that every breach would be reported to SDAIA within 72 hours.

Do you need a data protection officer (DPO)?

Article 32 of the Implementing Regulations requires a controller to appoint one or more DPOs in three cases:

• It is a public entity providing services that involve processing personal data on a large scale.
• Its core activities involve regular and systematic monitoring of individuals.
• Its core activities involve processing sensitive personal data.

The DPO can be an employee or an external contractor and acts as the direct point of contact with SDAIA. Even where it is not mandatory, naming an accountable privacy lead is good practice.

Do you need to register on the National Data Governance Platform?

SDAIA's Rules Governing the National Register of Controllers require registration on the platform for public entities and for private controllers whose main activity is processing personal data or who process sensitive data. Private entities register through an authorised representative using the Saudi Business Center's authorisation system. No registration fee currently applies, and SDAIA issues a registration certificate that must be renewed. The draft amendments would also make registration mandatory for controllers that transfer or disclose data outside the Kingdom.

Can personal data be transferred outside Saudi Arabia?

Yes, but only under the Transfer Regulations. Transfers must not affect national security or the Kingdom's vital interests and must be limited to the minimum data needed. The main routes are:

• Adequacy: the destination offers protection no less than the PDPL.
• Appropriate safeguards: SDAIA has published Standard Contractual Clauses and guidelines for Binding Common Rules for groups of companies.
• Limited exceptions, where no safeguard is available, subject to conditions.

Certain transfers also require a transfer risk assessment, and SDAIA publishes guidance for it. Sector regulators such as SAMA may impose their own approval requirements. If you rely on overseas cloud or SaaS, review our guide to cloud computing and data residency in Saudi Arabia.

What are the PDPL penalties?

• Disclosing or publishing sensitive data in breach of the law with intent to harm or for personal benefit: up to 2 years' imprisonment and/or a fine of up to SAR 3 million.
• Other violations: a warning or a fine of up to SAR 5 million.
• Fines may be doubled for repeat offences, proceeds may be confiscated and decisions may be published at the violator's expense.
• Individuals who suffer harm can claim material or moral compensation in court.

PDPL compliance checklist

Step	What to do	Evidence to keep
1. Map your data	Inventory systems, data categories, purposes, locations and processors	Data map and records of processing
2. Confirm lawful basis	Assign consent or an exception to every purpose	Lawful basis register, consent logs
3. Update notices	Publish a clear Arabic and English privacy policy	Approved policy and version history
4. Register and appoint	Check registration and DPO duties on the platform	Registration certificate, DPO appointment
5. Handle rights requests	Set up intake, identity checks and 30-day tracking	Request log and responses
6. Assess risk	Run impact assessments for high-risk processing	Completed assessments and actions
7. Secure the data	Apply access control, encryption, logging and NCA-aligned controls	Security policies, audit results
8. Control transfers and vendors	Map cross-border flows; sign contracts and SCCs	Transfer register, processor agreements
9. Prepare for breaches	Write a 72-hour response playbook and test it	Playbook, exercise reports
10. Train and review	Train staff and review compliance at least annually	Training records, self-assessment

What do SDAIA's 2026 draft amendments propose?

On 6 October 2026, SDAIA opened public consultation on draft amendments to the Implementing Regulations through the Istitlaa public consultation platform, closing on 5 November 2026. The drafts are not yet in force; if approved, they would take effect 60 days after publication in the Official Gazette. Key proposals include a requirement to store personal data inside the Kingdom (with transfers still permitted under the regulations), 72-hour breach notification regardless of harm, expanded impact assessment triggers for emerging technologies and automated decisions, wider mandatory registration and DPO duties, a 20-business-day deadline to answer SDAIA, and stronger marketing consent evidence. Plan for them now.

What does the PDPL mean for AI and cloud projects?

AI raises PDPL questions at every stage. Training or fine-tuning a model on customer records needs a lawful basis and minimisation. Sending prompts containing personal data to an AI service hosted abroad is a cross-border transfer. Automated decisions about individuals are a likely impact assessment trigger. SDAIA has also published Generative AI Guidelines (January 2024) and runs an AI ethics self-assessment on its platform. Practical answers include anonymising data before it reaches a model, keeping inference inside Saudi data centres, and choosing cloud regions in the Kingdom. Our article on data sovereignty and on-premise AI covers the architecture, and the same principles apply to Arabic chatbots that collect customer data.

What is the next step?

Start with a data map and a gap assessment against the checklist above, then fix the highest-risk gaps first: breach readiness, cross-border transfers and sensitive data. Amwaj designs PDPL-aligned architectures, data residency and NCA-aligned security controls. Explore our cybersecurity and compliance service or email info@amwajsol.sa to book a consultation. This guide is general information, not legal advice; confirm your specific obligations with qualified counsel.