Complete Guide to Saudi PDPL Compliance

The Personal Data Protection Law was issued under Royal Decree M/19 in 2021. Its Implementing Regulations and the separate Personal Data Transfer Regulations were published on 7 September 2023, and the law came into force on 14 September 2023 with a one-year grace period that ended on 14 September 2024.

The law reaches any processing of the personal data of individuals residing in the Kingdom. Critically, it applies extraterritorially: an organization with no Saudi establishment is still in scope if it processes the personal data of people in Saudi Arabia. This is the provision that pulls in regional headquarters structures, group service centres and offshore processing arrangements that were previously treated as out of scope.

The roles will be familiar. A Controller determines the purpose and means of processing; a Processor acts on the Controller's behalf. Where a group operates shared services across several Gulf markets, the first task is usually establishing which entity is the Controller for which processing activity, because that determines who registers, who notifies SDAIA of a breach, and who carries the penalty exposure.

Until the grace period ended, PDPL readiness was frequently deprioritised on the reasoning that the authority was still building capacity. That reasoning no longer holds. SDAIA has moved into active enforcement, and most violations are reviewed by dedicated committees constituted for the purpose under rules of procedure the authority has published.

SDAIA also holds a power that is easy to underweight when planning around fine ceilings: it can order the suspension of processing activities. For an organization whose core service depends on processing personal data, a suspension is a materially worse outcome than a monetary penalty, and it is not something a compliance budget can absorb after the fact.

The practical implication is sequencing. Registration, records of processing and breach procedures should be treated as the first tranche of work because they are the obligations most visible to the authority and most easily evidenced. Deeper programme work such as retention rationalisation can follow.

Processing requires consent or one of the alternative bases the law sets out, including performance of a contract, compliance with a legal obligation, and a legitimate interest that does not involve sensitive personal data. The exclusion of sensitive data from the legitimate interest route is a meaningful constraint and is a common source of error for teams porting a GDPR analysis across without revisiting it.

Where consent is the basis, it must be freely given and specific, and the data subject must be able to withdraw it. That means consent has to be captured as evidence rather than as a checkbox state, because the question the authority asks after the fact is not whether consent was collected but whether the organization can prove what was consented to, when, and on what notice text.

ConsentIQ addresses that directly: it records consent as tamper-evident, verifiable proof rather than a mutable database field, which is the form that stands up when a regulator or a data subject disputes the record months later.

Controllers must maintain records of processing activities. In practice the records requirement is the one that exposes how little most organizations know about their own estate, because it cannot be completed accurately without knowing where personal data actually lives. Reconstructing that from interviews and spreadsheets produces a document that is out of date the week it is signed off.

DiscoverIQ solves the underlying problem by scanning the estate directly and identifying where personal data resides, which turns the record of processing from a manual survey into something derived from the systems themselves. ComplyIQ then maintains it as a living artefact, along with impact assessments for high-risk processing and the breach register.

On breaches, controllers must notify SDAIA, and must inform affected data subjects where the breach is likely to cause them harm. Build the notification path before it is needed, including who makes the harm assessment and on what evidence, because that judgment is difficult to make well under time pressure.

Transfers of personal data outside the Kingdom are governed by the Personal Data Transfer Regulations, which sit alongside the main Implementing Regulations. Transfers are permitted where the destination provides an adequate level of protection, or under appropriate safeguards. Where a transfer falls outside the adequacy route, a documented transfer risk assessment is required.

This matters for almost every multinational, because the cloud services, support functions and analytics platforms that ordinary business runs on will typically involve at least one transfer outside Saudi Arabia. The assessment is not a one-off exercise: it needs to be revisited when a vendor changes its processing locations or sub-processors, which is why keeping the vendor inventory current is part of transfer compliance rather than separate from it.

The practical approach is to enumerate transfers from the record of processing rather than from procurement records, since procurement rarely captures where data physically ends up.