PDPL Compliance
Consulting

Yes. The PDPL applies extraterritorially: any entity outside the Kingdom that processes the personal data of individuals residing in Saudi Arabia is in scope, even with no Saudi office or entity. The Implementing Regulations also expect foreign controllers to designate a representative in the Kingdom. If you sell SaaS, run an app, or deliver services to Saudi residents from India, the UAE, Europe, or the US, you should assess applicability before SDAIA — or a Saudi enterprise customer — asks you to.

Two layers. Administrative: violation committees within SDAIA can issue warnings and fines of up to SAR 5 million per violation, and fines may be doubled for repeat violations. Criminal: under Article 35, disclosing or publishing sensitive data in violation of the law, with intent to harm the data subject or for personal benefit, carries up to two years’ imprisonment and/or a fine of up to SAR 3 million. Enforcement is no longer theoretical — SDAIA publicised 48 enforcement decisions in its first year of active enforcement.

The PDPL is GDPR-inspired but not GDPR-identical. The biggest differences: consent is the default lawful basis (legitimate interest exists only for non-sensitive data, added by the 2023 amendment); controllers may need to register on SDAIA’s National Data Governance Platform; cross-border transfers follow SDAIA’s own Transfer Regulations and SCCs (the adequacy list is still pending); and the PDPL adds criminal liability for unlawful sensitive-data disclosure. A mature GDPR programme is a strong head start, but it must be localised — notices, records, transfer mechanisms, and breach workflows all need PDPL-specific versions.

Only if you hit a trigger. A DPO is required where the controller is a public entity processing personal data at scale, where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve processing sensitive data. If triggered, the appointment is documented and the DPO is registered through SDAIA’s National Data Governance Platform. Many of our clients combine the role with an existing CISO or use a virtual DPO arrangement — we help you decide and document either path.

For most mid-size organisations, 6–12 weeks from kickoff to an operating compliance programme: scoping and data mapping first, then gap assessment, remediation and documentation, and finally breach-drill and handover. Engagements are custom-scoped to entity count, data flows, regulator deadlines, and whether cross-border transfer work and DPO support are in scope. We provide a fixed, all-inclusive quote after a short scoping call — in SAR, AED, or USD for Gulf engagements — with no hourly billing and no scope creep.

In Saudi Arabia, controllers must notify SDAIA within 72 hours of becoming aware of a personal data breach that may harm personal data or data subjects, and notify affected individuals without undue delay where their rights or interests are at risk. In the UAE, the federal PDPL requires notifying the UAE Data Office — and affected individuals where the breach prejudices their privacy — but exact timelines and forms await the pending executive regulations. We build one breach playbook that satisfies both, with the 72-hour clock as the design constraint.

Almost certainly yes. The PDPL protects individuals, not consumers — so employee records, candidate CVs, business points of contact, and the personal details of partners and vendor staff are all in scope when those individuals are in Saudi Arabia. A pure B2B model usually narrows your processing inventory; it rarely empties it.

Not as a blanket rule. The PDPL regulates transfers rather than mandating localisation: data may leave the Kingdom where a lawful pathway under the Transfer Regulations exists — adequacy (once SDAIA’s list lands), Saudi-form Standard Contractual Clauses, Binding Common Rules, or certification — with minimisation and, in defined cases, a transfer risk assessment. Sector rules can be stricter, so regulated industries should check their own regulators too.

Truly anonymised data — where no individual can be re-identified by any reasonably available means — falls outside the law. Pseudonymised data does not: if a key, lookup table, or combination of attributes can link it back to a person, it remains personal data with full PDPL obligations. Most "anonymised" analytics datasets we review are, on inspection, pseudonymised.

Size is not the test — the trigger is. Registration on SDAIA’s National Data Governance Platform applies on defined criteria, notably public entities, controllers whose main activity is processing personal data, and those processing sensitive data. A ten-person health-tech startup can be squarely in the registration net while a much larger trading company is not. We confirm your position as part of any gap assessment.