Your organisation may collect customer details, store employee records and share personal data with cloud providers or business partners. If someone asked your team to explain why this data is collected, where it goes and what allows you to use it under Saudi Arabia’s Personal Data Protection Law pdpl sdaia, could you give a clear answer?
A privacy policy may describe one process, while staff follow another. For example, a team might keep customer details longer than planned or give a supplier access to data without reviewing what it can see. Saudi data protection law compliance means checking that day-to-day data handling matches your organisation’s policies and the requirements of the law.
In February 2026, SDAIA introduced rules for companies that want to issue personal data protection accreditation certificates or carry out audits and inspections. These rules apply to those service providers. They do not mean every organisation needs to get certified or hire an auditor.
What Are the PDPL and SDAIA?
Saudi Arabia’s Personal Data Protection Law (PDPL) governs how personal data is handled, from collection and use to storage and sharing.
The Saudi Data and AI Authority (SDAIA) oversees the framework supporting the personal data protection law and issues related regulations and guidance. To understand the duties that apply to your organisation, start with these documents:
- The PDPL: The main law governing the processing of personal data.
- The Implementing Regulation: Sets out further requirements for applying the law.
- The Regulation on Personal Data Transfer Outside the Kingdom: Sets conditions for transferring personal data abroad.
- SDAIA guidance: Explains how to understand and apply the framework. Guidance is not itself law, although the legal requirements it explains may be binding.
Who Must Comply With the PDPL?
The PDPL applies to personal-data processing carried out in Saudi Arabia. It can also apply to organisations outside the Kingdom if they process personal data about people who live in Saudi Arabia. For this rule, where someone lives matters more than their nationality.
For example, a Saudi retailer handling customer details in Riyadh may be covered by the PDPL. A UK cloud provider may also be covered if it processes personal data about people living in Saudi Arabia.
Names, contact details, employee records and some system logs can count as personal data if they identify someone or can be linked to an individual. Information that cannot identify a person, directly or indirectly, may fall outside the PDPL’s definition.
Your organisation’s role also affects its duties under the PDPL:
- Controller: Decides why personal data is processed and how the processing will be carried out.
- Processor: Processes personal data on behalf of a controller.
A company may act as a controller for its employee records and as a processor for another business. Its responsibilities change with each role, so a service provider still has duties under the PDPL even when its client decides how the data will be used.
If you hire a service provider to process personal data, check that it can protect the data and put the key details in your contract. Agree on what data it will handle, why it needs it, how long it will process it and how it will tell you about a breach. A processor must notify the controller of a personal-data breach without undue delay.
What Counts as Personal Data?
Under Saudi Arabia’s PDPL, personal data is information that can identify a person, either directly or indirectly. It can include a single detail, such as a phone number, or several pieces of information that point to the same person.
Common examples include:
- Contact and identity details: Names, identity or passport numbers, email addresses, phone numbers and home addresses.
- Work and financial records: Employee files, salary details, performance reviews, bank account numbers and payment records.
- Digital information: IP addresses, cookies, device IDs, user accounts and online activity, when these can be linked to an individual.
- Photos, videos and other records: Images, recordings and documents that reveal who a person is.
The PDPL classifies certain information as sensitive personal data, which receives additional protection. This includes health information, genetic and biometric data used for identification, religious or political beliefs, and records of criminal convictions or offences. The law also includes other specific categories in its definition of sensitive data.
A customer profile or risk score can also count as personal data if it can be linked to an identifiable person.
Removing a name does not automatically make data anonymous. If someone can still be identified using other details, including information combined with the remaining data, it may still count as personal data. Anonymisation must prevent the person from being identified in line with the law.
Key PDPL Compliance Requirements
The Saudi Arabia PDPL requirements cover different duties depending on how an organisation handles personal data. The 11 areas below outline the main practices to review, although not every requirement applies to every organisation.
1. Lawful and purpose-limited processing
Before collecting personal data, establish why you need it and what you will use it for. The purpose must be clear, and the processing must have a lawful basis. Data collected to fulfil an order, for example, should not automatically be reused for unrelated marketing.
2. Data minimisation and accuracy
Collect only the personal data needed for the stated purpose. For example, remove fields from a customer form if the information is not needed for the service. You must also take appropriate steps to correct data that is inaccurate, incomplete or out of date.
3. Privacy notices and transparency
Explain how your organisation handles personal data in clear language. Depending on the circumstances, your privacy notice should state who collects the data, why it is needed, how long it will be kept and the legal basis for processing. It should also explain how individuals can exercise their rights. People should be able to find this information without searching through unrelated terms and conditions.
4. Consent and other legal bases
Consent is not the only reason your organisation may process personal data. The PDPL allows other legal grounds in certain situations, such as meeting a legal obligation. Legitimate interest may be available to private organisations, but it cannot be used for sensitive personal data.
If you rely on consent, tell people what they are agreeing to, keep a record of it and make it easy to withdraw. Some types of processing require explicit consent under the regulations, including processing sensitive or credit data.
5. Data-subject rights
People can ask to see their personal data, get a copy, correct it or have it deleted in certain situations. Set up a clear way to receive and verify these requests. The Implementing Regulation sets a response period of up to 30 days for requests to exercise data-subject rights. An extension of up to another 30 days is possible in specified circumstances, provided the individual is informed in advance and given the reason for the delay.
6. Data retention and secure disposal
Do not keep personal data for longer than it is needed for its purpose, unless a legal requirement or another applicable provision requires retention. When the data is no longer needed, destroy it or anonymise it in line with the law. Disposal procedures should also cover copies held in systems and backups, subject to applicable retention requirements.
7. Technical and organisational security measures
Protect personal data with safeguards suited to the risks involved. These may include access controls, encryption, security testing, staff procedures and plans for handling incidents. A written policy alone is not enough; the safeguards need to be put in place and maintained.
8. Keep a list of how you use personal data
Keep an up-to-date record of the personal data your organisation uses. Note why you use it, what types of data you handle, who receives it, whether it goes abroad and how long you keep it. Update the record when your practices change.
9. Check high-risk projects before they start
Some projects require a data-protection impact assessment before processing begins. It helps you spot how a project could affect people and decide what safeguards are needed. This may apply, for example, when you process sensitive data, combine data from different sources or offer a product or service that could seriously harm people’s privacy. Check Article 25 to see whether your project requires an assessment.
10. Data-protection officer requirements where applicable
Some controllers must appoint a data-protection officer (DPO) under SDAIA’s rules. Whether this applies depends on the circumstances set out in those rules, not simply on the size of the organisation. Check whether your organisation must appoint a DPO and make sure the person can advise on compliance and act as a contact for data-protection matters.
11. Personal-data breach management
If a personal-data breach occurs, investigate it promptly, record what happened and take steps to limit the harm. Under the Implementing Regulation, a controller must notify SDAIA within 72 hours of becoming aware of a breach when it could harm personal data or the affected individual, or affect their rights or interests. The controller must also notify affected individuals without undue delay when the breach may cause damage to their data or affect their rights or interests.
Your incident procedure should make clear who assesses a breach, who decides whether notification is required and who submits it. Not every security incident requires notification under the PDPL. Your team should assess what happened and apply the legal notification conditions before deciding what to report.
Recent PDPL Enforcement Actions in Saudi Arabia
Saudi Arabia’s recent enforcement actions show why businesses must follow the PDPL requirements in their daily operations. The Saudi Press Agency reported 48 decisions confirming PDPL violations in 2025. These violations included unlawful data processing or disclosure, inadequate security measures, and marketing without consent. Under Article 36, covered violations can attract fines of up to SAR 5 million. Controllers must also notify SDAIA of qualifying personal-data breaches within 72 hours of becoming aware of them. These findings reinforce the need to review consent records, protect personal data and maintain clear breach-response procedures.
Cross-Border Data Transfers in Saudi Arabia
Before using an overseas provider, find out where the data will go, who can access it and what legal protection applies.
The PDPL does not ban all transfers of personal data outside Saudi Arabia. It sets conditions that organisations must meet before sending data abroad or making it available to an overseas party.
Before approving a transfer, your organisation should know what data will leave the Kingdom, why the transfer is needed, who will receive it and what protections will apply. The transfer must meet the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.
What conditions apply to overseas transfers?
You can transfer personal data outside Saudi Arabia, but the rules depend on the destination and why the transfer is taking place. SDAIA maintains a list of destinations assessed as providing an adequate level of protection. For certain exemption cases, the regulation requires safeguards such as Standard Contractual Clauses, Binding Common Rules or an accreditation certificate. The right safeguard depends on the case; these options are not interchangeable.
You must carry out a risk assessment before a transfer covered by Article 4 of the transfer regulation, and before transferring sensitive data overseas on a continuous or widespread basis. The assessment should consider the purpose of the transfer, the data involved, the protections in place and the possible effects on people.
Cloud services: If your cloud provider stores or accesses personal data from outside Saudi Arabia, find out which countries are involved and which parties can access the data. Check the contract and confirm that the transfer meets the applicable requirements.
Overseas vendors: A support or development company based abroad may receive personal data while working on your systems. Check what data it can access, why it needs that access and what contractual and technical protections apply. An ISO certification can be useful evidence of security practices, but it does not by itself prove compliance with the PDPL’s transfer rules.
Sensitive personal data: Transfers involving health, biometric or other sensitive information need particular care. If the transfer is continuous or on a large scale, the regulation requires a risk assessment. Your organisation should check the conditions that apply before the transfer begins.
How to Prepare for PDPL Compliance
Use these resources as a starting point, not as proof that every legal obligation has been met.
- Map data and responsibilities. List the systems that handle personal data and confirm controller and processor roles.
- Review privacy practices. Check lawful processing, notices, consent, individual requests and retention.
- Check third parties and transfers. Review vendor arrangements and confirm that overseas transfers meet the applicable rules.
- Test security and response procedures. Check technical controls, document findings and review breach-response arrangements.
- Keep compliance evidence. Maintain required records, assign owners and track corrective work.
SDAIA provides guidance and online resources, including a self-assessment tool, to help organisations review their practices.
A KSA data privacy audit can help your organisation review its records, supplier arrangements, data-handling practices and security controls against applicable PDPL requirements.
Common PDPL Compliance Gaps
Written policies do not always match how an organisation handles personal data. Check whether any of these problems apply:
- Incomplete data inventory: Some systems or suppliers handling personal data may be missing from internal records.
- Unclear responsibilities: Contracts do not clearly define which party acts as controller or processor.
- Retention and transfer issues: Data is kept longer than needed or sent abroad without checking the applicable rules.
- Weak breach procedures: Staff are unsure who must assess an incident or decide whether SDAIA needs to be notified.
- Missing evidence: Supplier reviews, processing records or security-test results are scattered or out of date.
Assign an owner to each problem and track the corrective work until it is complete.
How Qualysec Supports PDPL Compliance
The PDPL requires organisations to protect personal data, but privacy policies and vendor agreements alone cannot prevent technical weaknesses from exposing it. Security testing can help find vulnerabilities in the applications, APIs and infrastructure that handle personal data.
Qualysec provides security testing services that can support this part of PDPL compliance.
| Service | How it supports the work |
| Security assessments | Reviews technical controls and looks for weaknesses that could expose personal data. |
| Web, API, mobile and cloud testing | Tests applications and infrastructure for vulnerabilities that could allow unauthorised access to data. |
| Vendor security assessments | Examines the security of systems and services provided by third parties. |
| Remediation and retesting | Helps teams prioritise findings and checks whether reported vulnerabilities have been fixed. |
| Security reports | Documents findings, severity levels and remediation guidance for internal reviews and compliance records. |
Qualysec is listed in the CREST marketplace as a penetration-testing provider and holds ISO 27001 certification. These credentials may support your security review, but they do not by themselves prove PDPL compliance.
Qualysec’s role is to help organisations find and verify technical weaknesses.
Conclusion
Pdpl sdaia compliance depends on how personal data is handled across your organisation, not just what a privacy policy says. Start by reviewing the systems that hold personal data, the reasons for processing it and the people or suppliers who can access it.
Record what needs to change, assign responsibility and follow up on outstanding work. Keep evidence of the decisions and actions taken.
Frequently Asked Questions
1. What does PDPL compliance mean?
It means handling personal data according to Saudi Arabia’s legal requirements. This includes lawful processing, protecting data, respecting individuals’ rights, managing vendors and keeping records where required.
2. Does the PDPL apply to organisations outside Saudi Arabia?
It can. The PDPL may apply to organisations outside the Kingdom that process personal data relating to individuals residing in Saudi Arabia. Its application depends on the processing and the law’s scope.
3. Must all personal data stay in Saudi Arabia?
No. The PDPL permits certain transfers outside the Kingdom when the applicable legal conditions are met. Organisations must check the permitted transfer route and put required safeguards in place.
4. What does SDAIA do under the PDPL?
SDAIA oversees the PDPL framework, issues supporting regulations and guidance, handles complaints and carries out enforcement functions under the applicable rules.
5. What records should an organisation keep for PDPL compliance?
Depending on its obligations, an organisation may need processing records, privacy notices, consent records, vendor agreements, transfer assessments, security-test reports and breach documentation. Records should reflect actual practices and be available when needed.
