Meet your Saudi PDPL obligations with less manual effort

The Saudi PDPL is Saudi Arabia's Personal Data Protection Law, issued by Royal Decree M/19 in 2021 and amended by Royal Decree M/148 in 2023. It regulates how personal data is collected, processed, disclosed, stored and transferred, and gives individuals rights to be informed, to access, correct and request destruction of their data. It is supported by Implementing Regulations and Transfer Regulations, and is enforced by the Saudi Data and AI Authority (SDAIA).

Any organisation that processes personal data in Saudi Arabia must comply, whether it is a public entity or a private business. The law also reaches organisations based outside the Kingdom that process personal data of individuals residing in Saudi Arabia. Processing by an individual for purely personal or family purposes is excluded. Controllers carry most obligations, but they must choose processors that provide sufficient guarantees.

The Saudi PDPL came into force on 14 September 2023, after amendments approved in March 2023 confirmed the date. Organisations were given a one year grace period to bring their processing into line, which ended in September 2024. From that point SDAIA expects full compliance, so controllers should already have their notices, records of processing, security measures and breach procedures in place.

Penalties can be significant. Under Article 36, violations can lead to a warning or a fine of up to SAR 5 million, which can be doubled for repeat violations. Under Article 35, disclosing or publishing sensitive data unlawfully with intent to harm the data subject or for personal benefit can lead to up to two years' imprisonment, a fine of up to SAR 3 million, or both. Courts can also award compensation for damage.

Yes. Article 20 requires controllers to notify the competent authority when they become aware of a leak, damage or unlawful access to personal data, and to notify affected individuals where it may harm them. The Implementing Regulations set the deadline for notifying SDAIA at 72 hours from becoming aware of the incident. A documented incident response procedure and breach register make this deadline achievable.

The Saudi PDPL follows many GDPR principles, including purpose limitation, data minimisation, data subject rights, security, breach notification, impact assessments and transfer restrictions. Differences include a stronger emphasis on consent as a legal basis, Saudi specific rules for health and credit data, and transfer conditions set by SDAIA's Transfer Regulations. A GDPR programme is a strong starting point, but it needs a Saudi specific gap assessment.

ISO 27001 helps with the security side of the PDPL. Article 19 requires controllers to take organisational, administrative and technical measures to protect personal data, and an ISO 27001 information security management system provides evidence of exactly that. It does not cover privacy obligations such as notices, consent, data subject requests or transfer rules, so those must be addressed separately.

Saudi PDPL is mapped in OneClickComply's control library and available on request. Once enabled, OneClickComply maps your controls to the law's articles, collects evidence automatically from connected tools, generates policies from your environment, and tracks processors and transfers in its vendor risk register. OneClickComply supports your compliance work but does not certify compliance, which remains your organisation's responsibility under SDAIA's supervision.