Saudi Arabia's personal-data law, consent-first and enforced by SDAIA.
The Saudi Personal Data Protection Law (PDPL), Royal Decree M/19 of 2021 as amended by M/148 of 2023, read with its Implementing Regulations and the Transfer Regulation, is the Kingdom's cross-sectoral personal-data law, regulated by SDAIA. It is consent-first, economy-wide across the public and private sectors, extraterritorial, and fully enforceable since 14 September 2024.
The standard
Saudi Arabia Personal Data Protection Law (Royal Decree M/19 of 2021, as amended by M/148 of 2023)
Who needs it
Any organisation, Saudi or foreign, that processes the personal data of individuals in the Kingdom or offers them goods and services. Especially consumer apps, SaaS, fintech, health, e-commerce and any business handling Saudi customers' or employees' data.
43
Law articles, fully mapped
The basics
The PDPL governs how any organisation processes the personal data of individuals in the Kingdom, and it reaches organisations outside Saudi Arabia that process the data of people residing there. Processing generally needs consent unless one of the Law's exceptions applies, and sensitive, health and credit data carry extra conditions. SDAIA runs the National Data Governance Platform, where you register, notify your DPO, report breaches and file data-subject matters.
It covers the full lifecycle: a ten-element privacy policy and collection notices, the data-subject rights (be informed, access, obtain a copy, correct, destroy) on a 30-day clock, a written Record of Processing kept for five years, security aligned to the NCA controls, 72-hour breach notification, impact assessments, processor contracts, and cross-border transfers under adequacy, standard contractual clauses, binding common rules or certification with a transfer risk assessment.
Why it matters
SDAIA's violation committees issued 48 decisions in 2025. Penalties run to SAR 3 million and imprisonment for unlawful disclosure of sensitive data, and up to SAR 5 million for other violations, doubled for repeat offences, plus compensation claims.
Serving Saudi users makes PDPL compliance a condition of doing business. Enterprise buyers and public-sector tenders now ask how you handle consent, rights, breaches and cross-border transfers.
No adequacy list has been published, so transfers out of the Kingdom rely on standard contractual clauses, binding common rules or certification, each with a transfer risk assessment. Build it once and it stops being a blocker.
Consent by default, with the Law's exceptions and a documented legitimate-interest assessment; explicit consent for sensitive, credit and automated-decision processing; easy withdrawal; a consent register.
A ten-element privacy policy, collection notices, and the data-subject rights handled within 30 days (extendable by 30), with a logged request process.
Security aligned to the NCA ECC/CCC, 72-hour breach notification to SDAIA via the DGP, a written Record of Processing with eight fields kept five years, and impact assessments for high-risk processing.
Seven-clause processor agreements, cross-border transfer on adequacy/SCCs/BCRs/certification with a transfer risk assessment, and registration in the National Register of Controllers.
Done by hand, the PDPL means chasing consent records, re-drafting notices per product, tracking 30-day rights requests in spreadsheets, standing up a breach process that can file within 72 hours, and proving a defensible cross-border position to SDAIA on request. That is exactly the repetitive, deadline-driven work software should run for you.
Do it once, reuse it everywhere. Evidence you collect for KSA PDPL is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.
See exactly how Compliance One maps KSA PDPL to your environment in a 30-minute walkthrough — and how much of it we handle for you.