Saudi Arabia: Personal Data Protection Law (PDPL)

The PDPL mandates explicit consent for data processing and grants individuals rights to access and correct their data. It places higher compliance sta...

Non-Compliance Penalties

Up to SAR 5,000,000 (Doubled for repeat offenders)

Effective Date

September 14, 2024

Regulatory Authority

Saudi Data and AI Authority (SDAIA)

Residency Rule

Strict. Cross-border transfers are restricted and require equivalent protection standards.

Executive Summary

The PDPL mandates explicit consent for data processing and grants individuals rights to access and correct their data. It places higher compliance standards on sensitive data (health, biometrics) and requires a Data Protection Officer (DPO) for large-scale processing.

View Official Legal Text