Regulations › Rest of world › Saudi Arabia
PDPL (Saudi Arabia)
Personal Data Protection Law (Saudi Arabia)
WhenIn effect since 14 September 2023
Who enforces itSaudi Data and AI Authority (SDAIA)
Who it applies toAnyone processing the personal data of people in Saudi Arabia, including from abroad.
Tell the regulatorNotify SDAIA within 72 hours of becoming aware of a breach that may harm data subjects
DPO requiredDPO required for public entities processing at large scale, and where core activities involve…
RegistrationNational Register of Controllers applies to public entities, controllers whose main activity i…
Transfers abroadTransfers need a specified purpose, minimum data, and adequacy, BCRs, standard clauses, certif…
Request deadlineRespond within 30 days, extendable by a further 30 days in limited circumstances
Maximum fineFines up to SAR 5 million (about USD 1.3m) per violation, doubled for repeat violations
Data protection authority Saudi Data and AI Authority (SDAIA)
- Address
- Northern Ring Road, Al Nakheel District, Riyadh 12382
- info@sdaia.gov.sa
- Phone
- +966 11 479 2700 800 122 1111
- Website
- sdaia.gov.sa✓
- Register
- Registration portal✓
- Breaches
- Report a breach✓
Registration, complaints and breach notices run through the National Data Governance Platform. Address from secondary sources.
Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change
Local help in Saudi Arabia
Law firms, training centers and other providers in Saudi Arabia can apply to be listed here. We check each one before it shows.
List your organizationRegulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws