PDPL Saudi Arabia — Personal Data Protection Law Explained

The PDPL is Saudi Arabia's primary data privacy regulation — comparable to the GDPR — governing how personal data is collected, processed, stored, and shared.

Who Does PDPL Apply To?

Any entity — Saudi or foreign — that processes the personal data of individuals residing in Saudi Arabia, including businesses, government bodies, healthcare providers, and online platforms.

Key Obligations

• Consent — collect data only with explicit consent, except in defined exceptions
• Purpose limitation — use data only for the purpose for which it was collected
• Breach notification — notify SDAIA of breaches within 72 hours
• Cross-border transfers — restricted unless the destination meets adequacy standards

Penalties

Violations can result in fines up to SAR 5 million, with higher penalties for intentional violations or repeat offenders.