Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Saudi Arabia’s Personal Data Protection Law (PDPPL) — officially Royal Decree No. M/19 of 1443H (2021) — is the Kingdom’s primary data privacy legislation, fundamentally changing how organisations handle personal data. Enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA), PDPPL aligns Saudi Arabia with global privacy standards like the GDPR while reflecting the regulatory realities of the GCC market.
Whether you are a Saudi organisation, a multinational operating in the Kingdom, or a service provider processing Saudi residents’ data, understanding PDPPL is no longer optional — non-compliance carries significant financial and reputational consequences.
What is PDPPL?
The Personal Data Protection Law was issued in September 2021 and came into full effect in September 2023. It governs the collection, storage, processing, disclosure, and transfer of personal data relating to natural persons in Saudi Arabia.
The law applies to: any organisation established in Saudi Arabia that processes personal data; any organisation outside Saudi Arabia that processes the personal data of individuals residing in Saudi Arabia; and government and private sector entities equally.
Key Definitions Under PDPPL
- Personal Data: Any information that identifies a specific natural person, including names, ID numbers, financial data, health information, location data, and online identifiers.
- Sensitive Personal Data: Health and medical records, genetic data, biometric data, credit information, and data relating to religious beliefs or criminal records.
- Data Controller: The entity that determines the purposes and means of processing personal data.
- Data Subject: The individual whose personal data is being processed.
Core Obligations for Organisations
1. Lawful Basis for Processing
Organisations must establish a valid lawful basis before collecting or processing personal data. Recognised bases include consent, contractual necessity, legal obligation, vital interests, and legitimate interests — provided these do not override the data subject’s rights.
2. Privacy Notice Requirements
Data controllers must provide clear privacy notices at the time of collection, disclosing the controller’s identity, purposes of processing, legal basis, data categories, retention periods, third-party sharing, international transfers, and the data subject’s rights.
3. Data Subject Rights
PDPPL grants Saudi residents rights of access, rectification, erasure, restriction, portability, and objection. Organisations must respond to requests within 30 days. These rights must be operationally enforceable — not just stated in a privacy policy.
4. Sensitive Personal Data
Processing sensitive personal data requires explicit, purpose-specific consent and enhanced security measures including encryption, strict access controls, and regular security assessments.
5. Data Breach Notification
Organisations must notify SDAIA within 72 hours of a breach that may harm data subjects, notify affected individuals where risk is high, and maintain a breach register documenting all incidents and remediation.
6. Cross-Border Data Transfers
Personal data may only be transferred outside Saudi Arabia where the destination provides adequate protection recognised by SDAIA, appropriate safeguards are in place (e.g., Standard Contractual Clauses), or the data subject has given explicit consent.
Penalties for Non-Compliance
- Unauthorised disclosure of sensitive personal data: Up to SAR 3 million and/or imprisonment
- Unlawful cross-border transfer: Up to SAR 5 million
- General violations: Up to SAR 1 million; doubled for repeat offences
- SDAIA may publish decisions against violating organisations publicly
PDPPL Compliance Roadmap
Step 1: Data Mapping and Inventory
Document all personal data held — where it comes from, how it is used, who has access, and where it goes. This data flow map is the foundation of all compliance work.
Step 2: Lawful Basis Assessment
For each processing activity, document the lawful basis. Update consent mechanisms to PDPPL standards — pre-ticked boxes, bundled consent, and implied consent are not compliant.
Step 3: Privacy Notice Review
Review all privacy notices for PDPPL compliance. Ensure notices are in plain Arabic and English, are prominent, and accessible before data collection begins.
Step 4: Data Subject Rights Procedures
Build operational workflows for access, correction, deletion, and portability requests — all within the 30-day window. Designate accountable team members for fulfilment.
Step 5: Vendor and Third-Party Assessment
Review all data processor agreements for PDPPL-compliant clauses. Assess cross-border transfer risks for any cloud or SaaS providers handling Saudi personal data.
Step 6: Technical Controls
Implement encryption at rest and in transit, least-privilege access controls, and regular security assessments. Align with NCA ECC controls — there is significant overlap with PDPPL’s technical safeguards.
Step 7: Breach Response Planning
Build and test an incident response procedure with PDPPL’s 72-hour notification window in mind. Conduct tabletop exercises annually to validate the process.
Frequently Asked Questions
Does PDPPL apply to organisations based outside Saudi Arabia?
Yes. PDPPL has extraterritorial scope. If your organisation processes the personal data of individuals residing in Saudi Arabia — through a website, app, or service — PDPPL applies, regardless of where your organisation is based.
Do I need to appoint a Data Protection Officer under PDPPL?
PDPPL requires organisations that process large volumes of personal data, or sensitive personal data at scale, to designate a responsible individual for data protection compliance. SDAIA’s implementing regulations provide further guidance on the threshold for mandatory designation.
How does PDPPL differ from GDPR?
PDPPL places stronger emphasis on explicit consent, has stricter cross-border transfer rules, and is enforced by a single authority (SDAIA). Organisations already GDPR-compliant will have a shorter path to PDPPL compliance but must address Saudi-specific requirements — particularly data residency and SDAIA notification obligations.
For organisations managing compliance across PDPPL, NCA ECC, and SAMA simultaneously, a GRC platform eliminates duplicate effort and keeps evidence in one place. Explore how GRCVantage helps Saudi organisations automate their compliance programmes.
