Saudi Arabia's Regulatory Landscape at a Glance
Saudi Arabia's framework rests on the PDPL, its Implementing Regulations, and the separate Data Transfer Regulations, supervised by the Saudi Data and AI Authority. National cloud computing and cybersecurity frameworks apply alongside, and sectoral requirements in financial services and health add further obligations.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Saudi Arabia
- Primary data protection framework
- Personal Data Protection Law, Royal Decree M/19 of 2021, as amended in 2023
- Key subordinate legislation
- Implementing Regulations and Data Transfer Regulations, issued September 2023
Key Regulations in Saudi Arabia
Personal Data Protection Law (PDPL)
The PDPL was issued by Royal Decree M/19 in 2021, amended by Royal Decree in 2023, and became enforceable following a grace period that ran to September 2024. It applies to any processing of personal data relating to individuals that takes place in the Kingdom, and to processing outside the Kingdom of personal data relating to individuals resident in the Kingdom.
The Law also covers the personal data of deceased persons where it would identify them or a family member, which is unusual and distinguishes it from most comparable regimes.
Depending on applicability, organisations may need to address:
- A lawful basis for processing, including consent and legitimate interests.
- Stricter conditions for sensitive data.
- A privacy notice given before collection.
- Records of processing activities.
- Appointment of a data protection officer where required.
- Registration on the national data controller register.
- Breach notification to SDAIA and affected data subjects.
- Conditions for transferring personal data outside the Kingdom.
The extension to the personal data of deceased persons where family members could be identified is a distinctive feature and should be reflected in retention and disclosure practices.
The 2023 Amendments
As originally issued, the PDPL took a restrictive approach, requiring personal data to be processed within the Kingdom in most cases and permitting transfers abroad only narrowly with authority approval. The 2023 amendments removed the general localisation default and reframed transfers around adequacy and safeguards.
The amendments also introduced legitimate interests as a lawful basis, which the original text lacked, significantly widening the options for routine commercial processing.
Changes introduced may include:
- Removal of the general requirement to process personal data inside the Kingdom.
- Introduction of legitimate interests as a lawful basis.
- A transfer regime based on adequacy determinations and appropriate safeguards.
- Revised provisions on marketing and on credit data.
- Changes to the penalty structure for certain violations.
Compliance programmes built against the 2021 text will be materially out of date; the amended Law and the 2023 Regulations are the operative framework.
Implementing Regulations
The Implementing Regulations issued in September 2023 provide most of the operational detail, covering privacy notices, records of processing, the conditions for relying on legitimate interests, data protection officer requirements, impact assessments, breach notification, and data subject request handling.
Areas addressed in the Regulations may include:
- Content required in a privacy notice.
- The record of processing activities and its particulars.
- The assessment required before relying on legitimate interests.
- Criteria for appointing a data protection officer.
- Impact assessment triggers and methodology.
- Timeframes for responding to data subject requests.
Because the Regulations carry the operational detail, compliance is assessed against them as much as against the Law itself.
Data Transfer Regulations
Transfers of personal data outside the Kingdom are governed by separate Data Transfer Regulations. Transfers are permitted where the destination has been assessed as providing an adequate level of protection, or where appropriate safeguards are in place such as binding common rules within a group, standard contractual clauses, or certification.
Where neither adequacy nor a safeguard is available, transfers may proceed only in limited enumerated situations, and a risk assessment is required in defined cases.
Organisations transferring data out of the Kingdom may need to consider:
- Whether an adequacy determination covers the destination.
- Which safeguard mechanism is available and appropriate.
- Whether a transfer impact or risk assessment is required.
- The limited exceptions where no safeguard exists.
- Restrictions applying to sensitive data and to onward transfers.
- That the transfer must not prejudice national security or the Kingdom's interests.
The requirement that a transfer not prejudice national security or the Kingdom's vital interests is an overriding condition with no equivalent in European transfer analysis.
Cloud, Cybersecurity and Sectoral Frameworks
National frameworks apply in addition to the PDPL. The National Cybersecurity Authority issues controls that regulated and government-linked entities are expected to implement, and cloud computing regulatory frameworks classify data and set hosting expectations. Financial institutions are subject to Saudi Central Bank requirements, and health data to Ministry of Health rules.
Sectoral considerations may include:
- National cybersecurity controls applicable to the entity.
- Cloud computing data classification and hosting expectations.
- Saudi Central Bank outsourcing and cloud requirements.
- Health data handling and hosting rules.
- Government and public sector data classification policies.
Even though the PDPL's general localisation default was removed, sectoral and cloud frameworks may still constrain where particular data can be hosted.
Marketing, Credit Data and Registration
The PDPL restricts the use of personal data for marketing, generally requiring consent and a means of opting out, and contains specific provisions on credit data including a requirement to notify the data subject before disclosing credit information.
SDAIA operates a national register of data controllers, and controllers are expected to register and keep their particulars current.
Organisations may need to consider:
- Consent and opt-out mechanics for direct marketing.
- Notification requirements before disclosing credit data.
- Registration on the national data controller register.
- Restrictions on using personal data for marketing obtained for another purpose.
- Record-keeping to evidence consent.
Confirm the current registration requirements and timetable with SDAIA, as the register and associated obligations have been rolled out progressively.
Who Needs to Comply With Saudi Data Protection Law?
The PDPL and related requirements may apply to:
Organisations in the Kingdom
Public and private entities processing personal data of individuals where the processing takes place in Saudi Arabia.
International companies
Organisations outside the Kingdom processing personal data relating to individuals resident in Saudi Arabia.
Processors
Service providers processing on a controller's behalf, which must follow instructions and meet the security requirements.
Organisations needing a DPO
Controllers meeting the criteria in the Implementing Regulations, which must appoint a data protection officer.
Employers
Organisations handling employee and candidate data, including health information treated as sensitive data.
Entities under sectoral frameworks
Financial institutions, healthcare providers, and government-linked entities subject to cybersecurity and cloud frameworks in addition to the PDPL.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the PDPL
Lawful Basis and Consent
Processing requires a basis under the Law. Following the 2023 amendments these include consent, legitimate interests of the controller, performance of a contract, compliance with a legal obligation, and protection of vital interests. Sensitive data cannot be processed on the basis of legitimate interests.
Relying on legitimate interests requires a documented assessment under the Implementing Regulations, and is unavailable for sensitive data.
Privacy Notice and Transparency
A privacy notice must be made available before collecting personal data, setting out the legal basis, the purpose, the personal data to be collected, how it will be collected and used, the identity of the controller, whether it will be disclosed or transferred, and the data subject's rights.
Records and Impact Assessments
Controllers must maintain records of processing activities with the particulars set out in the Regulations, and must carry out an assessment of the impact of processing on personal data where the Regulations require it, including for high-risk processing and for certain products and services.
Data Protection Officer
A data protection officer must be appointed where the criteria in the Implementing Regulations apply, which include public entities providing services involving large-scale personal data, processing based on regular and systematic monitoring, and processing of sensitive data as a core activity.
The officer may be an employee or an external appointment, and the details should be published and available to SDAIA.
Breach Notification
A personal data breach must be notified to SDAIA within seventy-two hours of becoming aware of it where it may cause harm to the personal data or the data subject, and affected data subjects must be notified without undue delay where the breach may cause damage to their data or conflict with their rights or interests.
Confirm the notification channel and prescribed form with SDAIA, as these are specified administratively.
Transfers Outside the Kingdom
Transfers require adequacy, appropriate safeguards, or an enumerated exception under the Data Transfer Regulations, together with a risk assessment in defined cases, and must not prejudice national security or the vital interests of the Kingdom.
Data Subject Rights Under the PDPL
The PDPL gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects have the right to be informed of the legal basis and purpose for collecting their personal data.
Right of Access
Data subjects may request access to their personal data held by the controller, in accordance with the Regulations.
Right to Obtain a Copy
Data subjects may request a copy of their personal data in a readable and clear format.
Correction
Data subjects may request correction, completion, or updating of their personal data.
Destruction
Data subjects may request destruction of personal data no longer needed, subject to statutory retention requirements.
Withdrawal of Consent
Where processing is based on consent, data subjects may withdraw it at any time.
The Implementing Regulations set out the periods for responding to requests and the grounds on which a request may be refused.
Saudi Arabia's Regulatory Timeline
Saudi Arabia issued, amended, and then enforced the PDPL over three years.
- September 2021
PDPL Issued
Royal Decree M/19 issued the Personal Data Protection Law, originally including a general requirement to process personal data inside the Kingdom.
- March 2023
PDPL Amended
Amendments removed the general localisation default, introduced legitimate interests as a lawful basis, and reframed the transfer regime.
- September 2023
Regulations Issued
The Implementing Regulations and separate Data Transfer Regulations were issued, providing the operational detail.
- September 2024
Grace Period Ends
The compliance grace period expired, from which point the PDPL became enforceable against controllers and processors.
Important: SDAIA continues to issue guidance, adequacy determinations, and registration requirements. Confirm the current position from official sources before changing your compliance programme.
Data Protection Authorities in Saudi Arabia
The Saudi Data and AI Authority (SDAIA) is the competent authority for the PDPL. It issues regulations, rules, and guidance, operates the national data controller register, makes adequacy determinations for transfers, receives breach notifications and complaints, and supervises compliance. Supervision was contemplated to transfer to a dedicated data protection body in due course.
Other authorities are relevant depending on sector, including the National Cybersecurity Authority for cybersecurity controls, the Saudi Central Bank for financial institutions, the Communications, Space and Technology Commission, and the Ministry of Health for health data.
Confirm whether supervisory responsibility still sits with SDAIA or has transferred, as the Law envisaged a future transfer to a dedicated body.
Penalties for Non-Compliance
The PDPL distinguishes between violations. Disclosing or publishing sensitive data in breach of the Law can attract imprisonment of up to two years and a fine of up to SAR 3 million, and unlawfully transferring personal data outside the Kingdom can attract imprisonment and a fine. Other violations of the Law and its regulations attract a warning or a fine of up to SAR 5 million, which may be doubled for repeat offences.
A competent court determines criminal penalties, while a committee formed by SDAIA considers other violations and imposes administrative penalties. Courts may also order confiscation of proceeds and publication of the judgment at the offender's expense. Data subjects may separately claim compensation for damage through the courts, so exposure is not limited to regulatory penalties.
How RegulatoryBridge Supports Compliance in Saudi Arabia
RegulatoryBridge helps organisations assess Saudi Arabia's regulatory requirements and coordinate their compliance activities with wider international programmes.
PDPL Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Registration Assessment
Review whether your processing requires a data protection officer, and the registration and record-of-processing obligations SDAIA operates.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and SDAIA Notification
Evaluate breach assessment procedures, escalation responsibilities, SDAIA notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers out of the Kingdom against the Data Transfer Regulations, including adequacy determinations, appropriate safeguards, and risk assessment requirements.
Sectoral Compliance Coordination
Help organise requirements across the PDPL, cloud computing and cybersecurity frameworks, financial sector rules, and health data requirements.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, SDAIA guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Saudi Arabia Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Saudi Arabia.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Saudi Arabia Compliance
Need PDPL support in Saudi Arabia?
We support your data protection officer arrangements, SDAIA registration and interactions, and transfer documentation - so your global product team doesn't have to.