Compliance & Governance
What is Saudi Arabia's Personal Data Protection Law (PDPL)?
Saudi Arabia's PDPL has applied since 14 September 2023, with SDAIA as regulator. Scope, obligations, 72-hour breach notice, transfers and penalties.
By VigilbasePublished
Saudi Arabia's Personal Data Protection Law (PDPL) governs the processing of personal data in the Kingdom, including processing from outside the Kingdom of personal data of individuals residing in it. It was issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H. According to the Saudi Data and AI Authority (SDAIA), it came into force on 14 September 2023, with a one-year grace period for compliance that ended on 14 September 2024. SDAIA is the competent authority that oversees its implementation.
Who issued the PDPL and who enforces it?
The law was issued by Royal Decree and is supported by two regulations: the Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom, whose current version SDAIA published in August 2024. Council of Ministers Decision No. 98 made SDAIA the competent authority for two years, during which a transfer of the responsibility to the National Data Management Office (NDMO) was to be considered. SDAIA's Data Governance Platform states that SDAIA oversees the law's implementation, and the platform handles controller registration and breach notifications.
Who must comply with the PDPL?
The law applies to any processing of personal data relating to individuals that takes place in the Kingdom, by any means, and to processing of personal data of individuals residing in the Kingdom by any party outside it. Processing for purely personal or family use is excluded, as long as the data is not published or disclosed to others; the Implementing Regulation clarifies that professional, commercial, and non-profit uses are not personal or family use. Some controllers must also register on SDAIA's national register.
1.Public entities.
2.Controllers whose main activity is based on personal data processing.
3.Controllers that process sensitive data.
4.Individuals who process personal data for purposes beyond personal or family use.
What are the main PDPL obligations?
The law sets the principles; the Implementing Regulation sets the detail. In outline, a controller must:
1.Process personal data only with the data subject's consent or under one of the exceptions the law provides, such as legitimate interest where no sensitive data is involved. Sensitive data, credit data, and decisions based solely on automated processing need explicit consent.
2.Use data only for the purposes for which it was collected, limited to the minimum necessary.
3.Keep written records of processing activities for as long as the processing lasts and for five years after it ends.
4.Appoint a data protection officer where a public entity processes personal data on a large scale, where core activities require regular and systematic monitoring of data subjects, or where core activities are based on processing sensitive data.
5.Take organizational, administrative, and technical security measures, adopting the National Cybersecurity Authority's controls, or recognized best practices where those controls do not apply.
6.Carry out impact assessments for higher-risk processing, such as sensitive data or large-scale monitoring.
7.Transfer personal data outside the Kingdom only under the transfer regulation's conditions, such as an adequate level of protection or safeguards like standard contractual clauses, with a transfer risk assessment where the regulation requires one.
What rights do data subjects have?
Data subjects have the right to be informed about processing, to access their data, to obtain it in a readable and clear format, to have it corrected, completed, or updated, and to have it destroyed when it is no longer needed. They can withdraw consent at any time. Controllers must respond to requests within 30 days, extendable by up to 30 more days in the cases the Implementing Regulation allows.
How must personal data breaches be reported?
Under Article 24 of the Implementing Regulation, a controller must notify SDAIA within 72 hours of becoming aware of a breach that could harm the personal data or the data subjects, or conflict with their rights or interests. The notification describes the incident, including when the controller became aware of it, the data categories and number of people affected, the risks, and the measures taken. If some information is not available within 72 hours, it must follow as soon as possible with a justification for the delay. Controllers must also tell affected data subjects without undue delay when the breach may harm them, and keep copies of the reports and the corrective measures taken.
What are the PDPL penalties?
Disclosing or publishing sensitive data in violation of the law, with intent to harm the data subject or for personal benefit, is punishable by imprisonment of up to two years, a fine of up to SAR 3 million, or both. Other violations of the law or its regulations can lead to a warning or a fine of up to SAR 5 million, imposed by a committee of the competent authority. Fines can be doubled for repeat violations, up to twice the limit.
Where does Vigilbase help with PDPL evidence?
The PDPL's security and breach obligations depend on knowing what happened, quickly. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, and each investigation records the evidence, the action taken, and the verification result. That helps you assemble the facts a 72-hour notification asks for, such as when the incident was detected and what was done to contain it. Because the Implementing Regulation points controllers to the NCA's controls, the same operating record also supports evidence for the NCA ECC. Security logs can contain personal data, so include any security provider that receives them in your PDPL assessment, including where the data is stored, and bring those requirements to scoping.
About this guide
This guide summarizes the PDPL, its Implementing Regulation, and SDAIA guidance as published in October 2026. It is not legal advice. Confirm current requirements with SDAIA's publications and your legal counsel, especially for registration, transfers outside the Kingdom, and sector rules such as those of the Saudi Central Bank.
Key Takeaways
✓The PDPL applies to processing in Saudi Arabia and to processing from abroad of data about people residing in the Kingdom.
✓SDAIA is the competent authority; the grace period for compliance ended on 14 September 2024.
✓Controllers must notify SDAIA of a harmful personal data breach within 72 hours of becoming aware of it.
✓Penalties reach SAR 5 million per violation, doubled for repeats, and up to two years' imprisonment for unlawful disclosure of sensitive data.
Sources
- SDAIA: Personal Data Protection Law, English text (PDF)
- SDAIA: Implementing Regulation of the Personal Data Protection Law (PDF)
- SDAIA: Regulation on Personal Data Transfer outside the Kingdom (PDF)
- SDAIA: Guide to the PDPL for controllers and processors (PDF)
- SDAIA: Rules governing the National Register of Controllers (PDF)
- SDAIA Data Governance Platform: Personal Data Protection Law
Related Solutions
Vigilbase services related to this guide
Frequently Asked Questions
When did the Saudi PDPL come into force?
According to SDAIA, the PDPL came into force on 14 September 2023. Organizations had a one-year grace period to comply, which ended on 14 September 2024.
Who enforces the PDPL in Saudi Arabia?
The Saudi Data and AI Authority (SDAIA), as the competent authority. A committee formed by its president examines violations and issues warnings or fines.
How quickly must a personal data breach be reported under the PDPL?
Within 72 hours of the controller becoming aware of it, if the breach could harm the personal data or the data subjects or conflict with their rights or interests. Affected data subjects must be told without undue delay when the breach may harm them.Security operations responsibilitiesWhat a SIEM does
What are the fines under the Saudi PDPL?
Up to SAR 5 million per violation, which can be doubled for repeat violations. Unlawfully disclosing or publishing sensitive data with intent to harm or for personal benefit can also lead to up to two years' imprisonment, a fine of up to SAR 3 million, or both.
Does the PDPL apply to companies outside Saudi Arabia?
Yes, when they process personal data of individuals residing in the Kingdom. SDAIA's Data Governance Platform also has a registration route for entities outside the Kingdom.
Get Started
Ready to Improve Your Security?
Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.