Saudi PDPL · Personal Data Protection Law of the Kingdom of Saudi Arabia
Saudi PDPL compliance consulting for a data protection programme ready for SDAIA's questions.
Build a compliance programme for Saudi Arabia's Personal Data Protection Law that holds up when SDAIA, a Saudi client's auditor or a data subject asks: a legal basis for every activity, a published privacy policy, rights requests answered on time, breaches reported to SDAIA within 72 hours, transfers out of the Kingdom justified and a record of processing ready to hand over. Sterling's expert and experienced consultants design the programme with your legal, technology and operations teams, prepare the evidence and stay with you once it runs, in 60+ countries. We ensure a successful Saudi PDPL compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by SDAIA, the Kingdom's data protection regulator
8,100+ client engagements in 60+ countries.
Saudi PDPL client experience
What it is
What is the Saudi PDPL and what is it used for?
The Personal Data Protection Law is Saudi Arabia's general law on personal data. It governs processing of personal data in the Kingdom by any means, and reaches organisations abroad that process personal data relating to its residents. Its 43 articles give individuals rights over their data, make consent the starting point, and require controllers to publish a privacy policy, secure data, report breaches, assess the impact of processing, keep a record of processing activities and send data abroad only on defined terms. The Saudi Data and Artificial Intelligence Authority (SDAIA) supervises the Law, without prejudice to the Saudi Central Bank's powers, and runs the National Data Governance Platform, where controllers register and notify breaches and individuals complain.
The Law sets its own penalties: fines of up to SAR 5 million and, for disclosing or publishing sensitive data to cause harm or for personal benefit, up to two years' imprisonment (details in the FAQs). No badge makes an organisation compliant; compliance is what your records, notices, contracts and controls show when SDAIA, a client or a complainant looks.
Current text. The Law was issued by Royal Decree M/19 of 9/2/1443H (16 September 2021) and amended by Royal Decree M/148 of 5/9/1444H (27 March 2023). It came into force on 14 September 2023; the one-year period controllers were given to adjust ended on 14 September 2024. The operational detail sits in SDAIA's Implementing Regulation and its Regulation on Personal Data Transfer outside the Kingdom, with SDAIA rules and guidelines on the data protection officer, the National Register of Controllers, standard contractual clauses, binding common rules, transfer risk and processing records. Confirm the current version of each on SDAIA's platform before relying on any summary. Saudi PDPL vs GDPR: what differs and what does not
Who it is for
Who needs to comply with the Saudi PDPL?
Article 2 sets the reach: processing in the Kingdom, and processing by any party abroad of personal data relating to its residents. The only exclusion is an individual's purely personal or family use, provided the data is not disclosed to others. SDAIA's platform has registration routes for government, private and non-profit entities, and for entities outside the Kingdom. Organisations come to Sterling from four starting points:
- You operate in Saudi Arabia. Employees, customers, patients and visitors all generate personal data, and the Law covers all of it. A fast-growing business can find HR, CRM and CCTV data in unmapped systems and a privacy policy written for the company it used to be.
- You serve residents of the Kingdom from abroad. An online shop, an app, a SaaS platform, a regional head office in Dubai or a delivery centre in Manila processing Saudi residents' data falls within Article 2.
- A Saudi client or partner wants evidence. When data protection enters due diligence or a contract, the questions are specific: how the data is secured, whether it leaves the Kingdom and under which mechanism, and how fast you would report a breach, given the client's own 72-hour clock with SDAIA. The answer has to be records, not a paragraph in a proposal.
- You comply with the GDPR and assumed that covered Saudi Arabia. Much of the groundwork carries over, but the legal bases, registration, breach deadline, transfer mechanisms and regulator differ. A mapped difference is a plan; an assumed equivalence is a finding waiting to happen.
Business benefits
How Saudi PDPL compliance supports trust and business control
A PDPL programme proves its worth when personal data is tested: a Saudi client's questionnaire, a spreadsheet e-mailed to the wrong person, a former employee's request, a new cloud service hosted abroad. Each of those moments gets an owner, a procedure and a record.
- Saudi contracts that closeSecurity evidence, transfer mechanisms and a current privacy policy ready before procurement asks, not drafted under pressure.
- Breaches reported on timeAn incident procedure that assesses harm, gets notice to SDAIA within 72 hours of becoming aware, tells affected people when the breach may harm them and records every incident.
- Rights requests handled properlyRequests to be informed, to access, to obtain a copy, to correct or to destroy data, and consent withdrawals, logged, verified and answered within the period the Implementing Regulation sets.
- Transfers you can justifyEvery flow out of the Kingdom, to cloud providers, group companies or offshore teams, mapped with its purpose, its mechanism and any risk assessment.
- Lower exposureLegal bases documented, data minimised and destroyed on schedule, impact assessed before new processing: fewer openings for a fine of up to SAR 5 million or a complaint that becomes an inquiry.
- One programme across the regionThe same inventory, roles and controls extended to the UAE's law, the GDPR or other regimes, adding only the differences.
Judge the programme by numbers that show it working: activities with a documented legal basis, requests answered inside the deadline, hours from breach discovery to the notification decision. The number of policies written is not one of them.
Requirements
What are the main Saudi PDPL requirements?
The Law's 43 articles set the obligations; SDAIA's Implementing Regulation and Transfer Regulation fix procedures, deadlines and mechanisms. The table maps the articles that shape a programme to practice; legal interpretation stays with your legal advisers.
| PDPL article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 4 and 21 Rights of the data subject | Honour the rights to be informed of the legal basis and purpose, to access the data, to obtain it in a clear and readable form, to have it corrected, completed or updated, and to have it destroyed once no longer needed; answer requests within the period the Implementing Regulation sets | A request procedure with identity checks, a log with the deadline visible and retrieval through the data inventory |
| Art. 5 and 6 Consent and its exceptions | Process personal data with consent unless a case in the Law applies, such as processing another law requires, public-body processing for security or judicial purposes, or the controller's legitimate interest where it does not prejudice the data subject's rights and interests and no sensitive data is involved; allow consent to be withdrawn at any time | A legal-basis register per activity, consent records showing what was agreed and when, and a documented assessment wherever legitimate interest is used |
| Art. 12 and 13 Privacy policy and notice at collection | Make available a privacy policy stating the purpose, the data required, how it is collected, stored and processed, and the data subject's rights; when collecting from the person, give the legal basis, the purpose, whether providing the data is mandatory, who is collecting it, the recipients, any transfer outside the Kingdom and their rights | A policy written from the data inventory, a notice per collection channel (website, app, forms, recruitment, CCTV) and version control |
| Art. 18 and 19 Destruction and security | Destroy personal data without delay once the purpose has been achieved, unless a law requires retention for a set period or it relates to pending judicial proceedings; protect it with organisational, administrative and technical measures, including in transfer | A retention schedule with destruction records, and security controls commonly aligned in practice with ISO/IEC 27001 or the National Cybersecurity Authority's controls |
| Art. 20 Personal data breaches | Notify the competent authority on becoming aware of a breach, and the data subject where it may harm their rights or interests; SDAIA expects its notice within 72 hours of becoming aware, through the National Data Governance Platform | An incident procedure with a harm assessment, the 72-hour clock, notice templates, a breach register and a rehearsal |
| Art. 22 Impact assessment | Assess the impact of processing personal data, as the Implementing Regulation specifies; SDAIA's platform provides an impact assessment service | A screening question in every project, product launch and procurement, an assessment template and register, and sign-off before processing starts |
| Art. 29 Transfer outside the Kingdom | Transfer personal data abroad only for the purposes the Law lists, without prejudice to national security or the Kingdom's vital interests, with adequate protection at the destination or the safeguards and exceptions the Transfer Regulation allows, and only the data needed | A transfer map covering cloud hosting, group companies and offshore support, with the mechanism per flow (SDAIA's standard contractual clauses, binding common rules or another permitted route) and any risk assessment |
| Art. 30 Supervision and the data protection officer | Cooperate with SDAIA's supervision and provide the documents it requests; appoint one or more people responsible for personal data protection in the cases Article 32 of the Implementing Regulation sets (see the FAQs) | A documented DPO decision checked with SDAIA's determination tool, a role description, and registration on the National Data Governance Platform where SDAIA's register rules apply |
| Art. 31 Record of processing activities | Keep a record with at least the controller's contact details, the purpose, the categories of data subjects, the recipients, any transfer outside the Kingdom and the expected retention period, for the period the regulations set, and provide it to SDAIA on request | The record produced from the data inventory, kept current through change control, with SDAIA's guideline on processing records to hand |
What does useful Saudi PDPL evidence look like?
A record of processing that matches the systems people use, legal-basis decisions with their reasoning, consent records, the privacy policy and notices, a request log with response dates, a breach register showing when each incident was found and when SDAIA was told, impact assessments, a transfer map naming each mechanism, destruction records, the DPO decision and the platform registration. We build them from your actual processing and keep them in Effivity from the first workshop.
Saudi PDPL requirements explained, article by articleCompliance process
How do you become Saudi PDPL compliant?
Build the programme, run it, then demonstrate it. Sterling designs and builds it with your team; SDAIA and your clients' auditors judge whether it is enough, and neither accepts a consultant's opinion as evidence.
- 01Settle what the programme has to cover.Entities in and outside the Kingdom, your role as controller or processor per activity, sector regulators, whether registration and a DPO are required, and who will judge the result.
- 02Gap analysis: review the current position against the Law and its regulations.The gap analysis inventories processing, systems and data flows, transfers included, tests consents, notices, contracts and controls against each obligation, keeps what works and agrees actions, owners and dates.
- 03Implement the controls and record them as they run.Decide legal bases, publish the privacy policy and notices, set up request, breach and destruction procedures, put transfer mechanisms in place, complete the impact assessments due, register where required, document the DPO decision and train the people who handle data.
- 04Audit, review and address the findings.An internal audit against the Law and a management review with the DPO or privacy lead show what operates; findings are raised by us first and closed with evidence.
- 05Complete the regulator or customer review.Answer SDAIA's requests, a client audit or a due-diligence questionnaire from an evidence package that already exists, or add ISO/IEC 27701 certification if a certificate is wanted too.
- 06Keep the programme running after go-live.New systems trigger impact screening, new suppliers and destinations trigger transfer checks, the record follows change, and the annual internal audit and management review track SDAIA's guidance.
Test an offer by what it leaves behind: who maps the data, who decides the legal bases, whether documents are drafted from your processing or translated from a GDPR pack, and where the evidence will live. A "PDPL certificate" sold in a week changes nothing: SDAIA can ask for your record of processing, receives your breach notices and regulates your transfers. How to choose a credible Saudi PDPL provider · The certification buyer's checklist
Cost
How much does Saudi PDPL compliance cost?
The cost follows the amount and sensitivity of the personal data, the systems, suppliers and destinations that touch it, and how much exists today: a single Riyadh office with an HR system and a website is not a group with clinics, an offshore contact centre and a cloud platform. What does not change in a Sterling proposal: every component visible, the fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Activities, systems and suppliers to map, entities in and outside the Kingdom, controller and processor roles, transfer flows, deliverables, and how much of the work your team takes on (Design™ or Drive™) |
| Independent review | Fees of any third-party assessor or ISO/IEC 27701 certification body you choose, shown separately; SDAIA requests and client audits cost preparation time, not assessor fees |
| Internal resources and legal | Process-owner time for mapping, DPO or privacy-lead capacity, IT effort for access, destruction and security, translation where notices appear in Arabic and English, and any legal review |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, impact assessment support, a watch on SDAIA's rules, refresher learning and updates when the regulations change, under Sustain™ |
What moves the price
- Processing activities, systems and suppliers, and whether data flows are mapped today
- Whether sensitive data is processed, and at what scale
- Transfers out of the Kingdom, and how many destinations and recipients
- Entities in scope: Saudi Arabia only, or regional and offshore operations as well
- The deadline set by a client contract, a tender or a request from SDAIA
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, stated in writing
- Assessor, certification and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables rather than dates
- One all-inclusive proposal. No surprises, ever
Timeline
How long does Saudi PDPL compliance take?
Most programmes need three to eight months: shorter where an ISO/IEC 27001 system, a GDPR programme or a data inventory exists, longer where many systems, suppliers and destinations abroad must be mapped and contracted. Decisions set the pace more than writing does (legal bases, retention, transfer mechanisms, the DPO), with the time procedures need to run and leave records. The plan is built around those decisions, and Effivity tracks the milestones.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, contracts and existing records, and how quickly the data inventory, offshore processing included, can be completed |
| Build and implementation | Decisions on legal bases and retention, transfer clauses agreed with recipients abroad, registration, the DPO decision, IT changes and training |
| Evidence and review | Procedures operating long enough to produce records, impact assessments completed, then internal audit and management review |
| Regulator or customer review | The timing of client audits, questionnaires or SDAIA requests and, if a certificate is also wanted, the ISO/IEC 27701 certification body's schedule |
If a client audit, a contract date or an SDAIA request is already in the calendar, say so at the start. You will hear what can realistically be ready by then and which decisions must be taken first. Full compliance promised in a fortnight, before anyone has seen your data flows, is a sales line, not a plan.
Challenges
Common Saudi PDPL implementation challenges
PDPL programmes tend to stall on the same five problems. Each has a practical answer.
Consent was assumed, or collected and never recorded.
The Law makes consent the default and lists the exceptions. We decide each activity's basis with your legal advisers, document legitimate-interest assessments where that basis is used, and make every consent you rely on provable, with its wording, its date and a withdrawal route that works.
Nobody can say which personal data leaves the Kingdom, or how.
Cloud regions, group reporting, offshore support desks and software vendors all move data. We map each flow with its purpose and recipient, choose the mechanism the Transfer Regulation permits, use SDAIA's standard contractual clauses where they fit and record the risk assessment where it applies.
The GDPR programme was copied across without checking Saudi law.
The inventory, security controls, supplier management and training carry over. We document where the PDPL differs, from legal bases and registration to breach timing and transfers, and change only that, so one programme serves both laws.
Registration, the DPO decision and the breach route belong to nobody.
We assign each one: the platform registration and its upkeep, the DPO determination and appointment where required, and a breach procedure with named decision owners, a harm assessment and SDAIA's 72-hour deadline built in, rehearsed before a real incident.
Data is kept forever because nobody decided otherwise.
Article 18 requires destruction once the purpose has been achieved, unless a law requires retention or proceedings are pending. We agree a retention schedule with the business, apply it system by system, use SDAIA's guideline on destruction and anonymisation where it helps, and keep proof that it happened.
Your engagement
What your Saudi PDPL engagement includes
Your agreed scope covers what a working programme and a prepared team need, from one team under one all-inclusive proposal: mapping, decisions, documents, software, training and the review that shows it operates.
Scope, gap analysis and implementation plan
Entities, roles, systems, suppliers and destinations confirmed; every obligation tested; actions, owners and dates agreed before work starts.
Data mapping, records and documentation
The record of processing, legal-basis and retention decisions, privacy policy and notices, request, breach and destruction procedures, transfer documents and impact assessments, on Sterling's template sets and written for your processing.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before a client, SDAIA or a certification body looks.
Review readiness and support
Preparation for client audits, questionnaires and SDAIA requests, help with the platform registration and breach rehearsals, and support through ISO/IEC 27701 certification if you pursue it.
Compliance is assessed by SDAIA and your customers' auditors. Sterling consults; it does not give legal advice.
How we deliver
How Sterling supports your Saudi PDPL implementation
Every Saudi PDPL engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at every stage. How much of the work your team carries is your choice; the method, the software and the accountability stay constant.
- 01Design™Guided implementation: your privacy lead and process owners do the building, with Sterling's structure, templates, workshops and coaching behind them.
- 02Drive™Fully managed consulting: Sterling consultants carry the mapping, drafting and transfer documentation and prepare the registration with your teams and legal advisers.
- 03Sustain™Operation after go-live: impact assessment support, request and incident reviews, the annual internal audit, refreshers and new-hire training.
- 04Automate™The programme in Effivity: record of processing, legal bases, impact assessments, requests, breaches, transfers, suppliers, audits and management review in one workspace.
- 05Revise™Changes in SDAIA's regulations, rules and guidelines, new transfer mechanisms, and changes in your scope, systems or countries.
Week one settles the engagement team, the weekly session, the deliverables and the decision owners, so a gap shows in week three, not during a client audit.
How Sterling OS™ worksOften combined with
Standards organisations pair with PDPL (Saudi Arabia)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · Saudi PDPL programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Saudi PDPL.
Every Sterling PDPL engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope: the record of processing, legal bases and consents, privacy risks, impact assessments, transfers, requests, breaches with their notification times, training, audits and management review, in one place. When SDAIA or a client's auditor asks, you open a live system. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Legal bases, consent and withdrawal
The basis for every activity, consent evidence with wording and timestamps, legitimate-interest assessments, and withdrawals actioned and logged.
Requests logged, verified and answered
One log for every Article 4 right, with identity checks, the response deadline in view and each reply kept as evidence.
Privacy policy and collection notices
The policy and each channel's notice under version control, linked to the activities they describe, so changed processing prompts a changed notice.
Controls, incidents and the 72-hour clock
A privacy risk register linked to its controls, and an incident workflow with the harm assessment, SDAIA's deadline, notice templates and the breach register.
Screening, assessment and sign-off
A screening question for every new project, product or system, a template covering purpose, necessity, risks and measures, and approval before processing begins.
Transfer map, mechanisms and risk assessments
Each flow abroad with its purpose, recipient, destination and mechanism, the signed clauses or binding common rules attached, and any risk assessment.
The Article 31 record, kept current from the inventory
Produced from the data inventory with the contents Article 31 lists, updated when a system, supplier or purpose changes, and ready whenever SDAIA asks.
DPO, registration, audits, training and review
The DPO decision, the registration record, destruction evidence, the internal audit programme, training linked to Sterling Academy and management review decisions.
What this means at the audit
A Saudi client's auditor asks for the record of processing, the privacy policy, the breach register and the transfer documents; SDAIA can require the record of processing and the documents behind it. In Effivity each is a screen with dates, owners and evidence. Sustain™ then runs in the same workspace, so the next questionnaire is answered from a system that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventory, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS, BCMS and more when you integrate other standards
Saudi PDPL client experience
Client letters on file, available on request.
Signed client letters for Saudi PDPL are available on request. The client feedback wall lists every letter by standard.
Programmes with the Saudi PDPL in scope
Where the PDPL sits in a wider assurance programme.
- 01Integrated management systems
Gulf operations: security, privacy and cyber controls as one programme
How a programme of this kind runs: ISO/IEC 27001 supplies the security controls and the risk method; the PDPL's obligations (record of processing, legal bases, rights requests, breach notice to SDAIA, transfer mechanisms) map onto the same control set; and the National Cybersecurity Authority's controls, sector rules or UAE law, where they apply, share one evidence base, one audit calendar and one workspace.
Sterling Academy · Saudi PDPL e-learning
Train every employee on the Saudi PDPL, not just the privacy team.
Sterling Academy trains the whole workforce and the people who run the programme, with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Saudi PDPL awareness for every employee who handles personal data
- Practitioner courses for the DPO, process owners and the people who handle requests and incidents
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by department and a training report for a client auditor or SDAIA
- New hires trained as they join, so evidence is current when the next questionnaire arrives
- A Sterling consultant reachable when a learner needs one
Where we work
Where Sterling delivers PDPL (Saudi Arabia)
Keep exploring
Explore more about PDPL (Saudi Arabia)
Watch a video on how to comply with Saudi PDPL here.
Watch a video on Saudi PDPL requirements here.
Why Sterling
Want successful Saudi PDPL compliance? Come to Sterling.
Whether you are a Saudi company or a regional or offshore business serving clients in the Kingdom, Sterling builds one PDPL programme with clear ownership in each entity, across controller and processor roles, transfer routes and client contract terms.
Management systems in 60+ countries since 2003
Security and privacy programmes for service, technology and regulated businesses, with one engagement team accountable across every country you operate in.
All-inclusive proposal
One proposal covers consulting, Effivity, training and Academy access, and lists assessor, certification and legal fees separately. No surprises, ever.
A programme your people can run
Less paperwork, more control: procedures, training and software built around how data really moves, so staff follow the programme because it fits their work.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003, security and privacy programmes among them, and who build it right the first time, so a client audit or an SDAIA request confirms what already works.
The Sterling Promise
What our Saudi PDPL compliance success guarantee means
We stay with you until the agreed PDPL programme outcome is achieved: data mapped, legal bases decided, the privacy policy published, request, breach and transfer procedures operating, evidence in place and your team able to handle the next request, incident or audit without us. Clear explanations, practical delivery, included software and employee learning turn the fee into lasting capability.
Your engagement records the entities in scope, the roles, the agreed outcome and who is responsible for what. You provide accurate information about your processing and run the agreed controls. Compliance is assessed by SDAIA and your customers' auditors, and legal interpretation remains with your legal advisers. The commitment covers the agreed programme support; it is not legal advice or a guarantee against every breach, complaint or penalty.
After the programme is in place
What happens after Saudi PDPL compliance?
Compliance has no finish line. New systems, suppliers and destinations change the processing, requests and incidents keep coming, and SDAIA publishes rules and guidelines that refine how the Law applies. The programme absorbs each change through impact screening, transfer checks, updates to the record and the privacy policy, and the annual internal audit and management review.
Under Sterling OS™ Sustain™ we run that cycle with you (impact assessment support, a review of requests and incidents, a watch on SDAIA's publications, refresher training, the internal audit), so the programme is current whenever a client or SDAIA asks.
FAQs
Frequently asked questions about the Saudi PDPL
Is there a Saudi PDPL certification?
No certificate of compliance is issued under the Law itself. SDAIA supervises and enforces it; registering on its National Data Governance Platform produces a registration certificate, which shows that you registered, not that you comply. ISO/IEC 27701 certification from an accredited body is a separate, voluntary credential that does not replace the Law's obligations. If anyone offers a "PDPL certificate", ask who issues it and under which SDAIA rule, and check that rule on SDAIA's platform.
Does the PDPL apply to organisations outside Saudi Arabia?
Yes, where they process personal data relating to residents of the Kingdom: Article 2 covers such processing by any party abroad, and SDAIA's platform has a registration route for entities outside the Kingdom. A regional head office, an offshore service centre or an online shop with Saudi customers should map what it processes about residents and where the data goes.
When did the PDPL take effect, and is there still a grace period?
The Law came into force on 14 September 2023. Controllers had one year to adjust, and that period ended on 14 September 2024, so the Law applies in full and SDAIA enforces it. If your programme is not yet built, start where exposure is highest: legal bases, breach handling, transfers and the record of processing.
Do we have to register with SDAIA?
SDAIA's rules for the National Register of Controllers set who must register on the National Data Governance Platform, and in practice they reach most controllers. A private company registers through an authorised representative, delegated through business.sa, and the process includes the check on whether a data protection officer is mandatory.
Do we need a data protection officer?
Article 30 of the Law leaves this to the Implementing Regulation, whose Article 32 requires an appointment in three cases: public entities providing services that involve large-scale processing of personal data, controllers whose core activities require regular and continuous monitoring of individuals on a large scale, and controllers whose core activities consist of processing sensitive data. SDAIA publishes rules for the appointment and a tool on its platform to test whether the duty applies. Document the decision either way.
What has to happen within 72 hours of a personal data breach?
Article 20 requires the controller to notify SDAIA on becoming aware of a breach, and SDAIA expects that notice within 72 hours, through its platform. Where the breach may harm the people concerned, they are told as well, without undue delay. Every incident, notified or not, goes in the breach register. Processors serving Saudi clients should agree how fast they will alert them, because the client's clock starts when it becomes aware.
Can we rely on legitimate interest instead of consent?
Sometimes. Consent is the starting point, but Article 6 allows processing for the controller's legitimate interest where it does not prejudice the data subject's rights and interests and no sensitive data is involved. Record the interest, why the processing is needed for it and why it does not override the person's rights, and confirm the position with your legal advisers. Where consent is the basis, keep the proof and honour withdrawal at any time, as Article 5 provides.
Can personal data leave Saudi Arabia, for cloud hosting or a group company?
Yes, within Article 29 and the Regulation on Personal Data Transfer outside the Kingdom. The transfer must serve a purpose the Law permits, must not prejudice national security or the Kingdom's vital interests, must be limited to the data needed and needs adequate protection at the destination or a safeguard the Regulation allows, such as SDAIA's standard contractual clauses or binding common rules, with narrow exceptions. SDAIA publishes a guideline on assessing transfer risk, and sector rules, for banking, telecommunications or government data for example, can require approvals of their own.
What are the penalties under the PDPL?
Disclosing or publishing sensitive data in breach of the Law, with intent to harm the data subject or for personal benefit, can bring up to two years' imprisonment, a fine of up to SAR 3 million, or both. Other violations can bring a warning or a fine of up to SAR 5 million, imposed by a dedicated committee, and a repeat can be penalised up to double. Courts can confiscate gains from a violation, a penalty can be published at the violator's expense, and individuals can claim compensation for material or moral damage.
Before the first call
Prepare a useful Saudi PDPL readiness brief
No data inventory is needed before the first conversation: bring a short account of the personal data you handle in or about the Kingdom, and who is asking. Seven questions are enough:
- Who is asking, and what do they want to see: a Saudi client's questionnaire, a contract clause, a request from SDAIA, or your own concern?
- Which entities are involved, inside and outside the Kingdom, and are you a controller, a processor or both for each activity?
- Which systems, cloud services and suppliers hold the data, and where are they hosted?
- Do you process sensitive data, data about people who lack full legal capacity, or data used to monitor people on a large scale?
- What exists already: a privacy policy, consent records, a record of processing, a breach procedure, a platform registration, an ISO/IEC 27001 system or a GDPR programme?
- Who can make decisions and give time: a DPO or privacy lead, legal counsel, IT, the process owners?
- Which dates are already fixed: a client audit, a contract renewal, a response owed to SDAIA?
This is preparation for a discussion, not a scored assessment or a legal opinion.
Don’t be fooled by certification scams
If it takes ten days, it is not Saudi PDPL compliance.
Because the Law issues no certificate of compliance, the market sells substitutes: "PDPL certified" badges, a platform registration certificate presented as proof of compliance, GDPR template packs with the country name changed, and personal training certificates passed off as company credentials. They cost less than a programme, until a client's auditor asks for the record of processing or SDAIA asks when a breach was notified.
How to choose a credible Saudi PDPL provider
- Ask what will exist at the end: a record of processing, legal-basis decisions, a privacy policy and notices, transfer documents, impact assessments, rehearsed procedures and trained people.
- Ask what any offered certificate actually is. A registration certificate from SDAIA's platform proves registration; a private badge carries only its issuer's word. Ask who issued it and under which SDAIA rule, and check that rule yourself.
- Ask how the programme will be built from your real processing, with system owners and your legal advisers, not from a questionnaire and a translated GDPR pack.
- Identify who carries each task, which legal, assessor or certification costs are separate, and what support exists when a breach, a complaint or an SDAIA request tests the programme.
- Ask what your people will learn and where the evidence will be kept. A programme that lives on the consultant's laptop leaves when the consultant does.
- Walk away from "PDPL compliant in a week", "SDAIA-approved" claims nobody can trace to SDAIA, and one-page policies sold as a programme. Compliance is shown by a programme that operates, not by a badge.
Keep exploring
More on PDPL (Saudi Arabia) and related standards
Talk to a consultant
Plan your Saudi PDPL compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice