Saudi Arabia's Personal Data Protection Law took effect on 14 September 2023 and became fully enforceable on 14 September 2024 after a one-year grace period. Fines reach SAR 5 million and double for repeat offences, and SDAIA is reported to be actively enforcing in 2026. This checklist turns the law's main articles into tasks a compliance or engineering team can work through.
Where the Saudi PDPL stands in 2026
The PDPL was issued by Royal Decree M/19 on 16 September 2021 and amended by Royal Decree M/148 on 27 March 2023. It took effect with its Implementing Regulations on 14 September 2023, and the one-year grace period ended on 14 September 2024. The regulator is the Saudi Data and Artificial Intelligence Authority (SDAIA).
The law applies to processing in the Kingdom and to processing of Saudi residents' personal data from abroad. A company with no office in Riyadh can still be in scope if it collects data from people living in Saudi Arabia.
Lawful basis and consent
Under Article 5, consent is the default lawful basis unless an exception applies. Article 5(2) gives individuals the right to withdraw consent, so your policy should explain how to withdraw and that withdrawal does not affect earlier lawful processing. Article 4 sets out data subject rights, including access, correction, erasure and portability. Publish one clear route for these requests, such as a web form or a dedicated email address, and log each request and response.
The Saudi PDPL checklist
Work through the items below in order. Each one links to the article that creates the duty, so legal and engineering teams can trace every control back to the text. Where an item needs a decision rather than a document, such as whether you must register on SDAIA's platform, record the decision and the reasons in your compliance file.
| Checklist item | PDPL reference | Action |
|---|---|---|
| Publish a privacy policy before collection | Article 12 | Show it before or at the point of collection |
| Record a lawful basis | Article 5 | Consent by default, or a documented exception |
| Support data subject rights | Article 4 | Access, correction, erasure and portability routes |
| Delete data no longer needed | Article 18 | Set retention periods and destruction steps |
| Apply security measures | Article 19 | Encryption, access control, logging and backups |
| Report breaches | Article 20 | Notify SDAIA within 72 hours where harm may result |
| Assess high-risk processing | Article 22 | Run an impact assessment first |
| Control health and credit data | Articles 23 and 24 | Apply the extra safeguards these articles require |
| Market with consent only | Articles 25 and 26 | Prior consent, sender identity, easy opt out; no sensitive data |
| Control transfers abroad | Article 29 | Use the Transfer Regulations mechanisms |
| Appoint a DPO where needed | Article 30 | Public bodies, large-scale monitoring, sensitive data |
| Register on the national platform | Article 30(4) | Register where the rules require it |
| Keep records of processing | Article 31 | Keep them for five years after processing ends |
Breach notification through the National Data Governance Platform
Under Article 20 and the Implementing Regulations, a controller must notify SDAIA within 72 hours of becoming aware of a breach that may cause harm. The report is filed through SDAIA's National Data Governance Platform, and affected individuals must be told without undue delay.
Register on the platform before you need it. Article 30(4) and the Implementing Regulations require registration for public entities, controllers whose main activity is processing personal data, and controllers that process sensitive data. Discovering during a live incident that you have no account wastes hours of a short window.
Cross-border transfers
Article 29 and the Regulations on Personal Data Transfers outside the Kingdom allow transfers based on adequacy or appropriate safeguards. A risk assessment is required for safeguard-based transfers and for large-scale transfers of sensitive data. Only the minimum data needed may leave, and transfers must not harm national security. Your privacy policy should disclose that data is transferred, the purpose, and the mechanism relied on. Keep the risk assessment on file with the vendor contract it relates to.
NCA Essential Cybersecurity Controls
Government entities, their companies and operators of critical national infrastructure must also meet the National Cybersecurity Authority's Essential Cybersecurity Controls, ECC-2:2024. The framework has 4 main domains, 28 subdomains, 108 controls and 92 subcontrols covering governance, defence, resilience, and third-party and cloud security.
Two controls stand out for incident teams. Control 2-13-3 requires cyber incidents to be reported to the NCA, and subcontrol 2-12-3-5 requires event logs to be kept for at least 12 months. Vendors selling into Saudi government accounts should expect these controls in tender questionnaires.
Penalties and cookies
The PDPL allows a warning or a fine of up to SAR 5 million, doubled for repeat offences. Disclosing or publishing sensitive data with intent to harm or for personal benefit can lead to up to 2 years in prison and a fine of up to SAR 3 million, or either. DLA Piper reports that Saudi Arabia has no dedicated cookie law, so general notice and consent rules apply to cookies and trackers. Explain which cookies you use and let users accept or refuse non-essential ones.
Next steps
Assign an owner to each checklist row, set a review date, and test your breach process against the 72-hour window at least once before an incident forces the test. To check a draft policy quickly, XDQ xAgents (https://xagents.xdqlabs.com) compares a privacy policy against Saudi PDPL requirements such as Article 12 notice and Article 29 transfers and lists what is missing. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
When did the Saudi PDPL become enforceable?
The PDPL and its Implementing Regulations took effect on 14 September 2023. A one-year grace period followed, and full enforcement began on 14 September 2024. SDAIA is reported to be actively enforcing the law in 2026.
How long do I have to report a data breach in Saudi Arabia?
Within 72 hours of becoming aware of a breach that may cause harm. The controller notifies SDAIA through the National Data Governance Platform under Article 20 and the Implementing Regulations, and tells affected individuals without undue delay.
What is the maximum fine under the Saudi PDPL?
A warning or a fine of up to SAR 5 million, doubled for repeat offences. Disclosing sensitive data with intent to harm or for personal benefit can bring up to 2 years in prison and up to SAR 3 million in fines.
Does the Saudi PDPL apply to companies outside Saudi Arabia?
Yes. It covers processing of Saudi residents' personal data carried out from abroad, as well as processing inside the Kingdom. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- CMS: One year anniversary of the Saudi Personal Data Protection Law, CMS, 2024
- Secure Controls Framework: Saudi PDPL article mapping, Secure Controls Framework, 2023
- NCA Essential Cybersecurity Controls ECC-2:2024 (official), National Cybersecurity Authority (NCA), 2024
