Two-minute brief
Saudi PDPL requirements explained: video brief
A two-minute brief on the articles of Saudi Arabia's Personal Data Protection Law that shape a compliance programme.
Key takeaways
- Data subjects have rights to information, access, correction and destruction.
- Consent is required unless a case in the Law applies.
- Controllers keep a record of processing activities for inspection.
- Breaches are notified through SDAIA's platform.
- Transfers abroad follow the Transfer Regulation.
Rights and consent
The Law's 43 articles set the obligations, and SDAIA's Implementing Regulation and Transfer Regulation fix procedures, deadlines and mechanisms. This short film maps the articles that shape a programme. Legal interpretation stays with legal advisers.
Articles 4 and 21 set the rights of the data subject: to be informed of the legal basis and purpose of processing, to access the data, to obtain it in a clear and readable form, to have it corrected, completed or updated, and to have it destroyed once no longer needed, with requests answered within the period the Implementing Regulation sets. In practice that means a request procedure with identity checks, a log with the deadline visible and retrieval through the data inventory. Articles 5 and 6 make consent the basis for processing unless a case in the Law applies, such as processing another law requires.
Controller duties and transfers
Controllers must publish a privacy policy, collect only what the purpose requires, keep data accurate, retain it no longer than necessary and protect it with appropriate security measures. Breaches are notified to SDAIA through the National Data Governance Platform and, where required, to the people affected. Impact assessments are carried out for processing that calls for them, a record of processing activities is kept for inspection, and a data protection officer is appointed where required. Transfers of personal data outside the Kingdom are allowed only on the terms the Law and the Transfer Regulation set.
The Law, issued by Royal Decree in 2021 and amended in 2023, has been in force since 14 September 2023. It applies to any organisation processing personal data in the Kingdom and to organisations outside it that process personal data relating to its residents; purely personal or family use is excluded. SDAIA supervises and enforces it, without prejudice to the Saudi Central Bank's powers, and no certificate of compliance is issued under it.
PDPL (Saudi Arabia) at a glance
- Purpose
- Personal data protection in Saudi Arabia: lawful, transparent and secure processing, rights people can exercise, and records the regulator can inspect
- Relevant to
- Any organisation processing personal data in the Kingdom, and organisations outside it that process personal data relating to its residents; purely personal or family use is excluded
- Edition
- Personal Data Protection Law, Royal Decree M/19 of 16 September 2021, amended by Royal Decree M/148 of 27 March 2023; in force since 14 September 2023, and the one-year adjustment period ended on 14 September 2024
- Certification
- No certificate of compliance is issued under the Law itself. SDAIA supervises and enforces; registering on its National Data Governance Platform produces a registration certificate, which records registration, not compliance
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and readiness for SDAIA or client review, then Sustain™
- Cost and timing
- Total investment for a Saudi PDPL compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 8 months
PDPL (Saudi Arabia): questions people ask
Is there a Saudi PDPL certification?
No certificate of compliance is issued under the Law itself. SDAIA supervises and enforces it; registering on its National Data Governance Platform produces a registration certificate, which shows that you registered, not that you comply. ISO/IEC 27701 certification from an accredited body is a separate, voluntary credential that does not replace the Law's obligations. If anyone offers a "PDPL certificate", ask who issues it and under which SDAIA rule, and check that rule on SDAIA's platform.
Does the PDPL apply to organisations outside Saudi Arabia?
Yes, where they process personal data relating to residents of the Kingdom: Article 2 covers such processing by any party abroad, and SDAIA's platform has a registration route for entities outside the Kingdom. A regional head office, an offshore service centre or an online shop with Saudi customers should map what it processes about residents and where the data goes.
When did the PDPL take effect, and is there still a grace period?
The Law came into force on 14 September 2023. Controllers had one year to adjust, and that period ended on 14 September 2024, so the Law applies in full and SDAIA enforces it. If your programme is not yet built, start where exposure is highest: legal bases, breach handling, transfers and the record of processing.
Do we have to register with SDAIA?
SDAIA's rules for the National Register of Controllers set who must register on the National Data Governance Platform, and in practice they reach most controllers. A private company registers through an authorised representative, delegated through business.sa, and the process includes the check on whether a data protection officer is mandatory.
Do we need a data protection officer?
Article 30 of the Law leaves this to the Implementing Regulation, whose Article 32 requires an appointment in three cases: public entities providing services that involve large-scale processing of personal data, controllers whose core activities require regular and continuous monitoring of individuals on a large scale, and controllers whose core activities consist of processing sensitive data. SDAIA publishes rules for the appointment and a tool on its platform to test whether the duty applies. Document the decision either way.
Keep exploring
Related to this video
The complete guide
Everything on PDPL (Saudi Arabia)
Start with the PDPL (Saudi Arabia) page, or go straight to the guide you need.
On the PDPL (Saudi Arabia) page
- What are the main Saudi PDPL requirements?
- How do you become Saudi PDPL compliant?
- How much does Saudi PDPL compliance cost?
- How long does Saudi PDPL compliance take?
- Who needs to comply with the Saudi PDPL?
- How Saudi PDPL compliance supports trust and business control
- Frequently asked questions about the Saudi PDPL
More videos: Privacy and data protection
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your Saudi PDPL compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice