# Saudi Personal Data Protection Law (PDPL)

**Legal basis:** Royal Decree M/19 (16 Sep 2021), amended by Royal Decree M/148 (27 Mar 2023). Effective 14 Sep 2023; grace period ended — **fully enforced since 14 September 2024**. Implementing Regulations + Personal Data Transfer Regulations issued Sep 2023, amended Sep 2024. Regulator: **SDAIA** (Saudi Data & AI Authority).

## Scope
Processing of personal data of individuals residing in KSA, by entities inside the Kingdom or entities outside processing residents' data. Sensitive data: health, genetic, biometric, location, criminal/security data, and data revealing racial/ethnic origin or religious/intellectual/political belief.

## Core obligations
- **Lawful basis** — consent as default, with alternatives incl. contract, legal obligation, vital interests, and (added by M/148) **legitimate interest** (not available for sensitive data)
- **Privacy notices** before/at collection; purpose limitation and minimization
- **RoPA** (records of processing activities)
- **Controller registration** on SDAIA's **National Data Governance Platform** (dgp.sdaia.gov.sa)
- **DPO** appointment where SDAIA rules require (e.g., large-scale or sensitive processing)
- **Data subject rights**: access, correction, deletion, copy of data
- **Breach notification: 72 hours to SDAIA** via the platform (data-subject notification where risk to them)

## International transfers (Transfer Regulations, as amended 2024)
Mechanisms: transfers to countries with SDAIA-assessed **adequate protection**; **SDAIA Standard Contractual Clauses** in four modules (C2C, C2P, P2C, P2P); **Binding Common Rules** for groups; limited derogations. Minimize the data transferred; national-security carve-outs apply.

## Enforcement & penalties
- Fines up to **SAR 5,000,000** per violation (may double for repeat violations)
- Criminal exposure: up to **2 years' imprisonment** and fines for unlawful disclosure of sensitive data
- **Enforcement is active**: SDAIA violation committees issued roughly **48 decisions in the first enforcement wave (2025–26)** — unlawful processing, unauthorized disclosure, inadequate safeguards
- **Watch item (dated 2026-08):** SDAIA's April 2025 public consultation proposed PDPL amendments (incl. graduated penalties) — **not enacted as of August 2026**; advise confirming current status with SDAIA before relying on proposed changes