Saudi PDPL

IQWorks Research

Saudi Arabia

Personal Data Protection Law

Saudi Arabia's Personal Data Protection Law, issued under Royal Decree M/19 and enforced by SDAIA, governs the processing of personal data of individuals in the Kingdom, with fines reaching SAR 5 million and criminal liability for sensitive-data disclosure.

Source: IQWorks — iqworks.ai | Last updated: 2026-03-20

Effective

Sep 14, 2023

Jurisdiction

Saudi Arabia

Max Penalty

SAR 5 million, doubling to SAR 10 million for repeat violations, plus criminal liability of up to 2 years imprisonment for sensitive-data disclosure

Enforced By

Saudi Data and Artificial Intelligence Authority (SDAIA)

Who Does Saudi PDPL Apply To?

Any processing of the personal data of individuals residing in Saudi Arabia, including processing carried out by entities located outside the Kingdom.

Key Requirements

Lawful Basis and Consent

Processing requires consent or one of the alternative bases set out in the law, such as performance of a contract, compliance with a legal obligation, or a legitimate interest that does not involve sensitive personal data.

SDAIA Registration

Controllers are required to register on SDAIA's national data controller platform, which is the mechanism through which the authority maintains visibility of processing across the Kingdom.

Data Protection Officer

A DPO must be appointed where the criteria in the Implementing Regulations are met, including where core activities involve regular systematic monitoring or large-scale processing of sensitive personal data.

Records and Impact Assessments

Controllers must maintain records of processing activities and carry out an impact assessment for any product or service involving large-scale processing of personal data or processing that presents heightened risk.

Breach Notification

Controllers must notify SDAIA of a personal data breach, and must inform affected data subjects where the breach is likely to cause them harm.

Cross-Border Transfers

Transfers outside the Kingdom are permitted where the destination provides an adequate level of protection or appropriate safeguards apply. Transfers outside the adequacy route require a documented transfer risk assessment under the separate Personal Data Transfer Regulations.

Individual Rights Under Saudi PDPL

Right to be informed of the legal basis and purpose of processing

Right to access personal data held by the controller

Right to request a copy of personal data in a readable format

Right to request correction of inaccurate or incomplete data

Right to request destruction of personal data no longer required

Right to withdraw consent to processing

Frequently Asked Questions

What is Saudi PDPL?

Saudi Arabia's Personal Data Protection Law, issued under Royal Decree M/19 and enforced by SDAIA, governs the processing of personal data of individuals in the Kingdom, with fines reaching SAR 5 million and criminal liability for sensitive-data disclosure.

What are the penalties for Saudi PDPL non-compliance?

The maximum penalty under Saudi PDPL is SAR 5 million, doubling to SAR 10 million for repeat violations, plus criminal liability of up to 2 years imprisonment for sensitive-data disclosure. Enforcement is handled by Saudi Data and Artificial Intelligence Authority (SDAIA).

Who does Saudi PDPL apply to?

Any processing of the personal data of individuals residing in Saudi Arabia, including processing carried out by entities located outside the Kingdom.