Personal Data Protection Law
Saudi Arabia's first comprehensive data protection law, administered by SDAIA. It sets out consent, purpose limitation and data subject rights broadly aligned with international norms, with local data residency considerations for sensitive data.
Who it applies to
- Organisations processing personal data of individuals in Saudi Arabia
- Organisations outside the Kingdom processing Saudi residents' data in relation to offering goods or services
- Both public and private sector entities
Key requirements
- Consent or another lawful basis before processing
- Purpose limitation and data minimisation
- Notification of breaches that cause harm to the Saudi Data & AI Authority
- Data Protection Impact Assessments for high-risk processing
- Restrictions on cross-border transfer of personal data
Maximum penaltyFines up to SAR 5 million, doubled for repeated violations, alongside potential criminal referral for sensitive data misuse
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
Saudi Arabia's PDPL applies to: Organisations processing personal data of individuals in Saudi Arabia; Organisations outside the Kingdom processing Saudi residents' data in relation to offering goods or services; Both public and private sector entities.
The core obligations are: Consent or another lawful basis before processing; Purpose limitation and data minimisation; Notification of breaches that cause harm to the Saudi Data & AI Authority; Data Protection Impact Assessments for high-risk processing; Restrictions on cross-border transfer of personal data. Each is summarised in plain English above, with a link to the official text.
Effective: 14 September 2023 (enforcement phased in from 2024). Regulator: Saudi Data & AI Authority (SDAIA).
Fines up to SAR 5 million, doubled for repeated violations, alongside potential criminal referral for sensitive data misuse.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under Saudi Arabia's PDPL, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, rights requests and consent records sit in Consents Manager.
See how Praeferre automates Saudi PDPL compliance
Continuous monitoring, evidence and reporting for Saudi PDPL — alongside every other framework you need to satisfy.