Privacy & Data Protection · Saudi Arabia
Personal Data Protection Law
Saudi Arabia's first comprehensive data protection law, administered by SDAIA. It sets out consent, purpose limitation and data subject rights broadly aligned with international norms, with local data residency considerations for sensitive data.
REGULATORSaudi Data & AI Authority (SDAIA)
REGIONSaudi Arabia
EFFECTIVE14 September 2023 (enforcement phased in from 2024)
Who it applies to
- Organisations processing personal data of individuals in Saudi Arabia
- Organisations outside the Kingdom processing Saudi residents' data in relation to offering goods or services
- Both public and private sector entities
Key requirements
- Consent or another lawful basis before processing
- Purpose limitation and data minimisation
- Notification of breaches that cause harm to the Saudi Data & AI Authority
- Data Protection Impact Assessments for high-risk processing
- Restrictions on cross-border transfer of personal data
Maximum penaltyFines up to SAR 5 million, doubled for repeated violations, alongside potential criminal referral for sensitive data misuse
Go to the source
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Start your compliance journey
See how Praeferre automates Saudi PDPL compliance
Continuous monitoring, evidence and reporting for Saudi PDPL — alongside every other framework you need to satisfy.