Regulations › Rest of world › Saudi Arabia
PDPL (Saudi Arabia)
Personal Data Protection Law (Saudi Arabia)
WhenIn effect since 14 September 2023
Who enforces itSaudi Data and AI Authority (SDAIA)
Who it applies toAnyone processing the personal data of people in Saudi Arabia, including from abroad.
Tell the regulatorNotify SDAIA within 72 hours of becoming aware of a breach that may harm data subjects
DPO requiredDPO required for public entities processing at large scale, and where core activities involve…
RegistrationNational Register of Controllers applies to public entities, controllers whose main activity i…
Transfers abroadTransfers need a specified purpose, minimum data, and adequacy, BCRs, standard clauses, certif…
Request deadlineRespond within 30 days, extendable by a further 30 days in limited circumstances
Maximum fineFines up to SAR 5 million (about USD 1.3m) per violation, doubled for repeat violations
62%
of Saudi Arabia's 21 requirements are already met by European Union (GDPR). Here is what PDPL (Saudi Arabia) adds, biggest gaps first.
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDPL (Saudi Arabia) adds3 Applies to processing in the Kingdom and to processing outside it of personal data of individuals residing in the Kingdom, by any means.
PDPL Art. 2 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDPL (Saudi Arabia) adds3 Consent must be freely given, specific, clear, separate for each purpose and documented; explicit consent for sensitive data, credit data and automated decisions.
PDPL Art. 5; Implementing Regulation · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDPL (Saudi Arabia) adds3 No fixed age in the PDPL; legal guardians act for persons lacking full legal capacity, including minors.
Implementing Regulation (guardian provisions) · source ↗
MarketingPeople's rightsGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
PDPL (Saudi Arabia) adds3 Consent required before sending advertising or using personal data for direct marketing; easy opt-out required; no existing-customer exception confirmed.
PDPL Arts. 25-26; Implementing Regulation Arts. 28-29 · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDPL (Saudi Arabia) adds1 National Register of Controllers applies to public entities, controllers whose main activity is processing, sensitive-data processors and some individuals; no fees seen.
Implementing Regulation Art. 34 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPL (Saudi Arabia) adds2 Destroy data when no longer needed for its purpose or processed unlawfully, subject to legal retention exceptions.
PDPL Art. 18 · source ↗
LocalizationTransfersGap
GDPR– Not addressed
PDPL (Saudi Arabia) adds1 No general localization in force; sectoral rules (SAMA, telecom, government cloud) require local storage.
PDPL Art. 29; sectoral rules · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPL (Saudi Arabia) adds2 Unlawful disclosure of sensitive data with intent to harm or for gain: up to 2 years' imprisonment and/or SAR 3 million.
PDPL Art. 35 · source ↗
Already covered by GDPR: Lawful basis, Sensitive data, Rights, Request deadline, DPO required, DPO qualifications, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Maximum fine, Private action.
A gap means PDPL (Saudi Arabia) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws