Saudi Arabia Personal Data Protection Law (PDPL)

Why does it matter?

The PDPL is the first general personal data law in the Kingdom, and it carries its own enforcement machinery. Article 30 makes the Competent Authority responsible for supervision, lets it keep a national register of controllers, request documents, delegate duties and charge fees for data protection services; Article 37 gives its inspectors powers of control and inspection and the right to seize the means used in a violation; Article 36 sets up a committee of at least three members, including a technical expert and a legal advisor, to issue warnings and fines; and Article 34 lets any data subject complain to the authority directly. Article 33 adds licensing of accreditation bodies and of auditors of processing activities.

Key benefits include:

• Scope reaches outside the Kingdom

Article 2 covers processing in the Kingdom by any means and processing of residents' data by any party outside the Kingdom, and Article 33(4) tells the Competent Authority to set the tools for monitoring and enforcing against controllers and processors abroad; only personal and family use that is not published or disclosed is excluded.

• Consent that cannot be bundled

Consent is the default basis (Article 5), may be withdrawn at any time (Article 5(2)), may not be made a condition of a service unless the service directly relates to the processing (Article 7), and must be explicit in the cases the Regulations name; marketing requires data collected directly from the data subject with consent and never sensitive data (Article 26), and advertising messages need prior consent and an opt-out mechanism (Article 25).

• Breach notification runs to the regulator and the individual

Article 20 requires the controller to notify the Competent Authority upon knowing of any breach, damage or illegal access to personal data, and to notify the data subject where the incident would damage their data or prejudice their rights and interests, in the manner the Regulations set.

• Transfers need a purpose and a protection test

Article 29 allows transfer or disclosure outside the Kingdom only for a listed purpose (an agreement to which the Kingdom is a party, the Kingdom's interests, an obligation to which the data subject is a party, or purposes in the Regulations) and only where national security and vital interests are not prejudiced, an adequate level of protection at least equivalent to the law exists per the Competent Authority's assessment, and the data is kept to the minimum, with an exception for extreme necessity to protect life (29(3)).

• Penalties with a criminal tier

Disclosing or publishing sensitive data in breach of the law with intent to harm or for personal benefit carries imprisonment of up to two years and/or a fine of up to SAR 3 million (Article 35); other violations carry a warning or a fine of up to SAR 5 million, doubled for repeat violations (Article 36); courts may confiscate proceeds and order publication of the judgment (Article 38), and injured individuals may claim compensation (Article 40).

How does it work?

Lawful collection is defined narrowly. Article 10 says the controller may collect personal data only directly from the data subject and process it only for the purpose of collection, with seven exceptions: consent, publicly available data, a public entity acting for public interest, security, another law or judicial requirements, the data subject's vital interests, public health, safety or specific lives, data held in a form that cannot identify the subject, and the controller's legitimate interest without sensitive data. Article 11 requires the purpose to be directly related to the controller's purposes, the means of collection to be direct, clear and secure without deception or extortion, the content limited to the minimum, and collection ended when the purpose ends.

Transparency and rights handling follow a fixed pattern. The privacy policy of Article 12 states the purpose, the data collected, the means used, and how rights are exercised. The collection notice of Article 13 adds the legal basis, the collector's identity, the recipients and whether data will leave the Kingdom, the consequences of not providing data and the Article 4 rights. Disclosure is allowed only in the six Article 15 cases and is blocked by Article 16 where it would threaten security, prejudice a fair trial, endanger an individual or breach a professional or judicial obligation; Article 9 lets a controller limit access in narrow cases and requires refusal in the Article 16 situations.

Accountability rests on records, assessments and security. Article 31 requires records of processing activities with six minimum fields, from the controller's contact details to the expected retention period, available to the Competent Authority on request. Article 22 requires an impact assessment of processing in relation to any product or service, Article 19 requires organizational, administrative and technical measures including during transfer, Article 18 requires destruction without undue delay when the purpose ends unless a legal basis or a court case requires retention, and Article 30(2) leaves to the Regulations the cases in which a controller must appoint one or more personal data protection officers. Article 41 binds anyone who processes personal data to confidentiality after the relationship ends.

Key Elements

• Definitions (Article 1)

Nineteen terms, from Personal Data (any data that identifies an individual directly or indirectly, including name, identification number, addresses, contact numbers, license numbers, records, assets, bank and card numbers and photos and videos) and Processing (any manual or automated operation) to Sensitive Data, Genetic Data, Health Data, Credit Data, Public Entity, Controller and Processor.

• Scope and relation to other laws (Articles 2 and 3)

Processing in the Kingdom and processing of residents' data from abroad, including data of the deceased where it identifies them or a family member; personal and family use excluded; any other law or international agreement that gives better protection prevails.

• Data subject rights (Articles 4, 9, 21)

To be informed, to access, to obtain a readable copy, to correct and to destroy; access may be limited to protect the data subject or others or for public-entity security and judicial reasons; responses within the periods set by the Regulations.

• Consent and its exceptions (Articles 5 to 7)

Consent as the default, withdrawable at any time, never a condition of an unrelated service; the four Article 6 cases in which consent is not required.

• Controller duties (Articles 8, 10 to 14, 17 to 22, 31)

Processor selection and monitoring, direct and minimal collection, privacy policy, collection notice, accuracy, onward correction, destruction and retention limits, security measures, breach notification, response to requests, impact assessment and records of processing.

• Disclosure, marketing and research (Articles 15, 16, 25 to 28)

The six permitted disclosure cases and the nine blocking grounds; consent and opt-out for advertising; marketing only with directly collected, non-sensitive data and consent; research and statistics without consent where the data subject is not identifiable; no copying of identifying official documents except by law or on a public authority's request.

• Transfers outside the Kingdom (Article 29)

Permitted purposes, the three conditions (no prejudice to national security or vital interests, adequate protection at least equivalent to the law per the Competent Authority's assessment, minimum data), the extreme-necessity exception and the exemptions the Regulations may set.

• Supervision, licensing and penalties (Articles 30, 33 to 40)

Competent Authority powers and the national register of controllers; licenses for accreditation bodies and auditors; complaints; the SAR 3 million and two-year criminal tier for sensitive data disclosure, the SAR 5 million administrative tier, the violations committee, confiscation, publication of judgments, disciplinary action in public entities and compensation.

• Health and credit data; Regulations and entry into force (Articles 23, 24, 42, 43)

Stricter access and processing rules for health data and explicit-consent and notification rules for credit data under the Credit Information Law; the Regulations to be issued within 720 days of publication after coordination with the named ministries and authorities; the law in force 720 days after publication.

What does it cover?

The PDPL applies to any controller or processor, public or private, that processes personal data of individuals in the Kingdom, and to any party outside the Kingdom that processes personal data of individuals residing in it (Article 2(1)); controllers and processors may be public entities, natural persons or private legal persons (Article 1). Processing by an individual for personal or family use is excluded as long as the data is not published or disclosed (Article 2(2)). The Royal Decree keeps the National Cybersecurity Authority's powers intact (item Fourth), and the Council of Ministers Decision provides for memoranda with the Saudi Central Bank and the Communications and Information Technology Commission on the entities they regulate (items Sixth and Seventh).

What are its objectives?

Read together, the law's provisions set out what it is for:

To give individuals enforceable rights over their personal data and a direct route of complaint to the Competent Authority (Articles 4 and 34).

To make consent, or a stated legal exception, the basis of every processing operation and every change of purpose (Articles 5, 6 and 10).

To limit collection to the minimum needed for a directly related purpose and to end processing when that purpose ends (Articles 11 and 18).

To hold controllers accountable through privacy policies, notices, records of processing, impact assessments, security measures and breach notification (Articles 12, 13, 19, 20, 22 and 31).

To control the flow of personal data outside the Kingdom and to back the whole regime with inspection, administrative fines and criminal penalties (Articles 29, 35 to 38).

To keep the regime coherent with other laws and agreements that protect data better, and to review the law's results within five years (Article 3; Decision 98, item Tenth).

Framework in Context

The PDPL is the general law; sector rules and cybersecurity obligations sit alongside it. The Royal Decree states that its application does not prejudice the National Cybersecurity Authority's powers, so entities inside the NCA Essential Cybersecurity Controls scope answer to both regimes. The Council of Ministers Decision names the Saudi Central Bank, which keeps its own powers over the entities it supervises (Article 30(1)), and Article 24 preserves the Credit Information Law for credit data. The law delegates its detail to the Implementing Regulations and to the Regulation on the Transfer of Personal Data Outside the Kingdom, due within 720 days of the law's publication under Article 42.

Common Framework Mappings

Organizations that already run a privacy program map the PDPL's articles to other data protection laws and privacy standards so that one set of records, notices and request procedures serves every jurisdiction.

Mapped frameworks include:

APPI

GDPR

ISO 27701

LGPD

NIST Privacy Framework v1.0

Singapore PDPA