Saudi Arabia's Personal Data Protection Law (PDPL) has been enforced since the compliance period ended on 14 September 2024, and SDAIA's violation committees issued 48 decisions confirming violations during 2025. Most concerned ordinary failures: processing without a legal basis, unjustified disclosure, weak security measures and marketing messages sent without consent.
This guide is for compliance managers, data protection officers and business owners who process the personal data of individuals in the Kingdom.
What is the Saudi PDPL and who must comply?
The PDPL was issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H. It came into force on 14 September 2023, with a one-year period for controllers to comply. The Saudi Data and AI Authority (SDAIA) is the competent authority.
According to SDAIA, the law applies to any processing of personal data of individuals in the Kingdom, by any means. It also covers entities outside the Kingdom that process the personal data of individuals in it. Data of deceased people is included where it could identify them or their family.
Sensitive data carries the heaviest penalties. The law defines it to include health, genetic and biometric data, criminal convictions, racial or ethnic origin, and religious or political belief.
What did SDAIA's 48 violation decisions cover?
In January 2026 the Saudi Press Agency reported that SDAIA's Committees for Reviewing Violations had issued 48 decisions the previous year. Each one confirmed a violation and applied the penalties set by Article 36 of the law. SDAIA has not published the individual decisions, so the lessons below rest on the four violation types it named.
None of the four needs a sophisticated attacker. Each is a gap in governance that a regulator can prove from records, or from the lack of them. Here is what each type asks you to be able to show.
- Collecting and processing without a lawful basis: a record of processing activities that ties every purpose to a legal basis. The Implementing Regulation requires that record to be kept for five years after each processing activity ends.
- Disclosing personal data without legal justification: a disclosure procedure, access controls, and written agreements in place before data is shared.
- Missing organisational, administrative and technical measures: security policies, access management and an incident response plan that exist on paper and in practice.
- Marketing messages sent without consent: consent records you can retrieve per person, and an opt-out that works. One complaint with a screenshot can be enough to start a case.
Our guide to ISO/IEC 27701 privacy management shows how many organisations structure these records as one managed system.
What penalties can be imposed under the PDPL?
Under Article 36, a committee can issue a warning or a fine of up to SAR 5 million for each violation of the law or its regulations. The fine can be doubled for a repeat violation, up to twice the maximum. The committee weighs the type of violation, its seriousness and its impact.
Article 35 is a criminal provision handled by the Public Prosecution and the courts. It covers disclosing or publishing sensitive data in breach of the law, with intent to harm the data subject or gain a personal benefit. The penalty is up to two years' imprisonment, a fine of up to SAR 3 million, or both.
Because the cap applies per violation, one incident can lead to more than one penalty. A breach caused by weak controls and reported late, for example, may involve two separate failures.
What deadlines apply once something goes wrong?
The clocks are short, and most start only after the organisation is already under pressure. The table brings the key dates and response windows together, with the document that sets each one.
| Date or window | What it means | Source |
|---|---|---|
| 14 September 2023 | PDPL came into force | The law, as amended |
| August 2024 | SDAIA issued the Rules for Appointing Personal Data Protection Officer | DPO Rules, version 01 |
| 14 September 2024 | One-year compliance period ended and enforcement began | Reported in law firm analyses of the law's transition period |
| 72 hours | Notify SDAIA after becoming aware of a breach that could cause harm | Implementing Regulation, Article 24 |
| 5 days | Respond to a violation notice from a committee | Committee Rules of Procedure, Article 18 |
| 60 days | Appeal a committee decision to SDAIA from the date of notification | Committee Rules of Procedure, Article 21 |
The committee rules define a day as a Hijri calendar day. The law also gives anyone subject to a committee decision the right to appeal before the competent court. SDAIA publishes the law, the Implementing Regulation and the committee rules on its laws and regulations page.
Five days is not enough time to write policies after the event. A 72-hour breach notice is only realistic with an incident procedure that names its owners and has been rehearsed.
Who must appoint a Data Protection Officer?
Article 32 of the Implementing Regulation and SDAIA's DPO Rules require a controller to appoint a DPO in three cases. The first is a public entity providing services that involve large-scale processing. The second is a controller whose core activities need regular and systematic monitoring of data subjects. The third is a controller whose core activities are based on processing sensitive data.
The rules give practical tests. Large scale depends on the number of data subjects, the volume and type of data, geographical scope and the categories of people involved. Monitoring examples include wearable health data, behavioural analytics, location tracking, cookies and surveillance cameras.
The appointment must be in writing, and the DPO's contact details must go to SDAIA through the National Data Governance Platform. Processing employee data in HR is not a core activity under the rules. A health insurer processing health data, or a finance company processing credit data, is.
Are the Implementing Regulations changing?
Possibly. SDAIA consulted publicly in 2025 on proposed amendments to the Implementing Regulation, reported to cover privacy notices, direct marketing, record-keeping, complaints, the DPO role and controller registration. When this guide was reviewed we could not confirm that an amended text had been adopted.
Treat the amendments as proposed, not in force. Comply with the Implementing Regulation and DPO Rules published on SDAIA's site, and check that page before you change documented arrangements. Organisations that also hold ISO/IEC 27001 certification can often reuse their security controls as evidence for the PDPL's security duty.
How AGS can help
The Saudi PDPL Compliance Management System contains 118 editable documents in Microsoft Word, Excel and PowerPoint. It includes a PDPL regulatory compliance matrix, a personal data breach response procedure with notification templates, a records of processing register, consent management records and DPIA screening forms. More data protection and risk kits are in the Information Security, Risk and Business Continuity collection.
Frequently asked questions
Is the Saudi PDPL grace period over?
Yes. It ended on 14 September 2024, and SDAIA's committees issued 48 violation decisions during 2025.
How large are PDPL fines?
Up to SAR 5 million per violation, doubled for repeat violations. Disclosing sensitive data with intent to harm or for personal benefit can also bring up to two years' imprisonment.
How quickly must a data breach be reported in Saudi Arabia?
Within 72 hours of the controller becoming aware of it, where the breach could cause harm to the data or the data subject.
Can the DPO be an outside contractor?
Yes. The DPO Rules allow an executive, an employee or an external contractor, appointed under a written agreement.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by SDAIA or any Saudi government body, and they do not guarantee any regulatory outcome. This guide is not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
