Saudi Arabia · Regulation guide
Saudi Personal Data Protection Law (PDPL)
Issued by Saudi Data & AI Authority (SDAIA)
Applies to: Organisations that process personal data of individuals in Saudi Arabia, including organisations outside the Kingdom that process such data.
The PDPL sets the rules for collecting, using, disclosing and transferring personal data in Saudi Arabia, and SDAIA supervises it. It is in force and enforced, with implementing regulations and separate rules for transferring personal data outside the Kingdom.
Key themes include a lawful basis for processing, privacy notices, data subject rights (to be informed, to access, to correct and to have data destroyed), records of processing, security measures, breach notification to the regulator within set timeframes, and conditions for cross-border transfers. Some controllers must also register and appoint a data protection officer.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss Saudi PDPL with us
Gap assessment, control mapping or evidence tracking.
The path
How organisations typically get there
- 01
Map your data
Inventory the personal data you hold, why, where it is stored and who it is shared with.
- 02
Assess gaps
Compare notices, consents, retention, security and transfer practices with the PDPL and its regulations.
- 03
Fix and document
Update notices, consent flows, contracts with processors, retention schedules and records of processing.
- 04
Operate
Handle data subject requests, breaches and transfer assessments through defined workflows.
How we help
- ✓Data inventory and records of processing
- ✓PDPL gap assessment
- ✓Privacy notices, consent and processor contracts
- ✓Breach and data subject request workflows
- ✓Cross-border transfer assessment support
- ✓Privacy controls tracked alongside security controls
Related ISO standards
Related software guides
Saudi PDPL questions
Does the PDPL apply to companies outside Saudi Arabia?+
It can. The law covers processing of personal data of individuals in Saudi Arabia, including by organisations based elsewhere.
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.