The PDPL
FAQ

Yes. The PDPL applies by operation of law, not by invitation — every entity processing the personal data of individuals in Saudi Arabia has been expected to comply since full enforcement began on 14 September 2024. SDAIA does not owe you a warning letter before a violation committee owes you a fine.

Any entity — public or private, of any size, in any sector, inside or outside the Kingdom — that processes personal data of individuals residing in Saudi Arabia. That includes companies, government bodies, non-profits, and professional firms. Foreign entities are covered extraterritorially and are expected to designate a representative in the Kingdom.

Almost certainly. The law protects individuals, not consumer relationships: your employees, job candidates, business points of contact, directors named in contracts, and vendor staff are all data subjects. B2B narrows your processing inventory — it does not empty it.

Fully. Names, salaries, national IDs, performance reviews, attendance logs, and medical certificates are personal data — some of it sensitive. HR processing needs the same legal-basis mapping, notices, security, and retention discipline as customer data.

Yes, where physical records are organised and processed systematically — personnel files, signed contracts, visitor registers. Secure storage, retention limits, and destruction duties apply to the filing cabinet as much as the database.

Yes. Anything that can identify an individual directly or indirectly qualifies — online identifiers included. Analytics, advertising, and session data should be in your processing inventory with a documented legal basis like any other category.

Truly anonymised data — not re-identifiable by any reasonably available means — is outside the law. Pseudonymised data is not: if a key or attribute combination links it back to a person, it remains personal data. In our reviews, most datasets described as anonymised turn out to be pseudonymised.

Eight in practice: to be informed, to access their data, to obtain a copy, to correct it, to have it destroyed, to withdraw consent, to complain to SDAIA within 90 days, and to seek court-ordered compensation for harm. Each needs a workflow, not just a policy paragraph — see the rights section of our PDPL guide.

Plan for 30 days under the Implementing Regulations, with extension available only in defined cases. The clock covers verification, retrieval, and response — so intake routing and identity checks need to be designed for speed, not improvised per request.

The legal retention duty prevails — destruction rights yield to statutory obligations. The correct response is to document the retention basis, restrict the data to that purpose, and tell the requester plainly why full erasure is not available yet and when it will be.

Direct marketing generally needs its own informed, specific consent — bundled or implied consent does not meet the standard, and withdrawal must be as easy as the opt-in. The 2023 amendment’s legitimate-interest basis is narrow and does not behave like GDPR’s marketing workhorse, so EU-style soft-opt-in programmes usually need re-engineering for the Kingdom.

Administrative fines up to SAR 5 million per violation, doubled for repeat violations, issued by violation committees within SDAIA. Separately, unlawful disclosure of sensitive data — with intent to harm or for personal benefit — is a criminal offence carrying up to two years’ imprisonment and/or a SAR 3 million fine. Add the quieter costs: processing suspensions, failed enterprise deals, and compensation claims from harmed individuals.

Notify SDAIA within 72 hours of becoming aware of a breach that may harm personal data or data subjects, and notify affected individuals without undue delay where their rights or interests are at risk. The deadline is awareness-based — which makes detection capability and a drilled escalation path part of legal compliance, not just good security.

The PDPL is the baseline for personal data; sector regimes — SAMA’s frameworks for financial entities, health-sector rules, NCA cybersecurity controls — can layer stricter or additional duties on top. In practice you comply with both: the stricter requirement usually wins on any given point, and your control set should be designed once to satisfy the union.