Regulations › Rest of world › Saudi Arabia

PDPL (Saudi Arabia)

Personal Data Protection Law (Saudi Arabia)

In force privacy

WhenIn effect since 14 September 2023

Who enforces itSaudi Data and AI Authority (SDAIA)

Who it applies toAnyone processing the personal data of people in Saudi Arabia, including from abroad.

Tell the regulatorNotify SDAIA within 72 hours of becoming aware of a breach that may harm data subjects DPO requiredDPO required for public entities processing at large scale, and where core activities involve… RegistrationNational Register of Controllers applies to public entities, controllers whose main activity i… Transfers abroadTransfers need a specified purpose, minimum data, and adequacy, BCRs, standard clauses, certif… Request deadlineRespond within 30 days, extendable by a further 30 days in limited circumstances Maximum fineFines up to SAR 5 million (about USD 1.3m) per violation, doubled for repeat violations

Saudi Arabia's data protection law, enforced by SDAIA. Rules set when a data protection officer is required, and registration and breach notices run through the National Data Governance Platform.

62% coveredif you already meet GDPR. 8 requirements to work on.See the gap → 4 of 21requirements scored most demanding, each cited to the law.See all 21 → 43 sectionsindexed by topic, each linked to the official text.Read section by section →

The Association's practitioner brief for this law is on the way; the priority laws come first.

Recent developments

Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.

Sources

Text of the law Qanoniah (DPO Rules) · Legislature or public body

Dates and status checked against these sources on 18 October 2026. This page explains the law for practitioners; it is not legal advice.

Data protection authority Saudi Data and AI Authority (SDAIA)

Address: Northern Ring Road, Al Nakheel District, Riyadh 12382
Email: info@sdaia.gov.sa
Phone: +966 11 479 2700 800 122 1111
Website: sdaia.gov.sa✓
Register: Registration portal✓
Breaches: Report a breach✓

Registration, complaints and breach notices run through the National Data Governance Platform. Address from secondary sources.

Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change

Local help in Saudi Arabia

Law firms, training centers and other providers in Saudi Arabia can apply to be listed here. We check each one before it shows.

List your organization

102 laws in plain words. Free. Associate Membership is free and open to anyone in this work or moving into it. Join free as Associate

Browse the library

US states 40 Rest of world 37 European Union 12 US federal 12 United Kingdom 1

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL