The Saudi PDPL explained: scope, rights, breaches and enforcement

The Personal Data Protection Law (PDPL) is Royal Decree M/19 of 2021, amended by M/148 of 2023 and read with its Implementing Regulations and a separate Transfer Regulation. It is Saudi Arabia's cross-sectoral personal-data law, regulated by SDAIA, and it has been fully enforceable since 14 September 2024.

It is consent-first and economy-wide, covering both the public and private sectors, and it is extraterritorial: if you process the personal data of individuals residing in the Kingdom, you are in scope even if you sit outside Saudi Arabia. It even reaches the data of deceased persons where that data would identify them or their family.

The rights and the clock

Individuals have the right to be informed, to access their data, to obtain a readable copy, to correct or complete it, and to have it destroyed. You respond within 30 days, extendable by a further 30 with notice and reasons, and you keep a record of every request, including the ones made out loud.

• A ten-element privacy policy, available before you collect anything.
• A written Record of Processing with eight fields, kept for five years after an activity ends.
• Security aligned to the National Cybersecurity Authority controls.
• Breach notification to SDAIA within 72 hours, through the National Data Governance Platform, plus notice to affected individuals without undue delay.

What SDAIA expects now

Because the Law is enforced, the questions are concrete. SDAIA's violation committees issued 48 decisions in 2025. Penalties reach SAR 3 million and imprisonment for unlawful disclosure of sensitive data, and up to SAR 5 million for other violations, doubled for repeats, with compensation on top. A defensible programme has a current record of processing, a breach process that can file within 72 hours, a documented lawful basis for each activity, and a transfer position it can show on request.

The PDPL is not a project you finish. It is a state you stay in, and prove to SDAIA whenever they ask.