Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024, and organisations that process data about people in the Kingdom now carry GDPR-like duties with some distinctly Saudi twists. The law is backed by an Implementing Regulation, a separate Regulation on Transferring Personal Data Outside the Kingdom, and a growing set of SDAIA rules on data protection officers, the National Register of Controllers and standard contractual clauses. This guide explains who is covered, what the obligations are in practice, how breach notification and transfers work, where SDAIA's October 2026 draft amendments could change things, and what the law means for AI agents and the service accounts and API keys that touch personal data. It is written for security, privacy and engineering leads who need to turn the law into controls, not for lawyers drafting opinions.
Key takeaways
- Enforceable now: the PDPL (Royal Decree M/19 of 16 September 2021, amended by Royal Decree M/148 of 27 March 2023) came into force on 14 September 2023 and the one-year transition ended on 14 September 2024.
- Extraterritorial reach: it applies to processing in the Kingdom and to organisations outside it that process personal data of individuals in Saudi Arabia.
- 72 hours to SDAIA: under the current Implementing Regulation a controller notifies SDAIA within 72 hours of becoming aware of a breach that may cause harm, and tells affected individuals without undue delay.
- Transfers need a purpose and a mechanism: adequacy, SDAIA standard contractual clauses, binding common rules or certification, plus a documented transfer risk assessment in defined cases.
- Rules are still moving: SDAIA opened consultation on draft amendments to the Implementing Regulation on 6 October 2026 (closing 5 November 2026) that would widen breach reporting, DPO and DPIA duties and introduce a storage-in-Kingdom rule.
Scope: who and what is covered
The PDPL applies to any processing of personal data that takes place in the Kingdom, by any means, and to processing by entities outside the Kingdom that relates to individuals residing in Saudi Arabia. A foreign SaaS provider with Saudi customers is therefore in scope even with no local entity. Processing by an individual for personal or family purposes is outside scope.
| Concept | What the PDPL framework says | Practical note |
|---|---|---|
| Competent authority | Saudi Data and Artificial Intelligence Authority (SDAIA), acting through its National Data Governance Platform | Registration, DPO details and SDAIA correspondence run through the Platform |
| Personal data | Any data that identifies or can identify an individual, directly or indirectly | Includes device identifiers and log data tied to users |
| Sensitive data | Includes health, genetic and biometric data (among other categories) | Legitimate interest cannot be used; explicit consent is the usual basis; never for marketing |
| Credit data | Treated with extra protection alongside sensitive data | Explicit consent required |
| Controller and processor | Controller decides purposes and means; processor acts on its behalf | A processor that departs from instructions is treated as a controller |
| Extraterritorial | Covers entities abroad processing data of individuals in the Kingdom | Map Saudi data subjects in global systems, not just Saudi entities |
Sector rules sit alongside the PDPL: the Saudi Central Bank (SAMA) for financial institutions, the Communications, Space and Technology Commission for telecoms and cloud, and the National Cybersecurity Authority (NCA) for government bodies and critical national infrastructure. For the NCA control set, see the Saudi NCA Essential Cybersecurity Controls Guide; this guide does not repeat that content.
Key obligations
Lawful basis and consent
- Consent: must be freely given, specific, clear, obtained separately for each purpose, documented and easy to withdraw. Explicit consent is required for sensitive and credit data and for decisions based solely on automated processing.
- Other bases: contract, legal obligation, vital interests, public entity tasks and legitimate interest. Legitimate interest needs a documented balancing assessment and is not available for sensitive data.
- Marketing: direct marketing relies on consent with an easy opt-out.
Transparency and data subject rights
- Privacy notice: provided before or at collection, or within 30 days when data is obtained from a third party. SDAIA publishes a guideline on preparing a privacy policy.
- Rights: to be informed, access, obtain a copy, rectification, destruction (erasure) and withdrawal of consent. There is no general portability right as under GDPR.
- Response time: 30 days, extendable by up to a further 30 days in limited cases. See the DSAR Guide for workflow design.
Accountability
| Duty | Current requirement | Source instrument |
|---|---|---|
| Records of processing | Written, accurate and current record kept during processing and for five years after it ends; provided to SDAIA on request | Implementing Regulation; SDAIA records guideline |
| DPIA | Required for sensitive data, combining datasets, large-scale processing of children or people lacking capacity, continuous monitoring, new technologies and automated decision-making; a copy goes to processors acting for the controller | Implementing Regulation |
| Security | Organisational, administrative and technical measures to protect personal data, including during transfer | PDPL Article 19 and Implementing Regulation |
| Processor selection | Choose processors with sufficient guarantees and assess their compliance periodically | Implementing Regulation |
| DPO | Mandatory for public entities processing at large scale, and for controllers whose core activities involve regular and systematic monitoring or sensitive data | Rules for Appointing a Personal Data Protection Officer (August 2024) |
| National Register of Controllers | Public entities, controllers whose main activity is processing personal data, controllers processing sensitive data, and individuals processing for non-personal purposes register on the Platform; certificate valid up to five years and must be made publicly available | Rules Governing the National Register of Controllers |
A "core activity" in the DPO rules is one where the product or service cannot be delivered without processing personal data. Internal support functions such as HR do not count on their own. The DPO can be an employee, an executive or an external contractor, must be appointed in writing, and needs knowledge of risk management, breach handling and the regulatory requirements. The DPO rules add duties beyond the Implementing Regulation, including reviewing breach response plans and advising the teams that build and operate technology systems.
Breach notification
- Assess: decide whether the incident is a personal data breach that may cause harm to individuals or conflict with their rights or interests. That is the current trigger.
- Notify SDAIA within 72 hours of becoming aware, including a description of the breach, the number of affected individuals and further details the Implementing Regulation specifies. If 72 hours cannot be met, report as soon as possible and give reasons for the delay.
- Notify individuals without undue delay, in simple and clear language, where the breach may harm them.
- Keep evidence: retain a copy of each notification and a record of the corrective measures taken.
- Check sector duties: NCA incident reporting under the ECC, SAMA for financial institutions and CST for telecoms run in parallel with PDPL notification.
See the Breach Notification Laws by Country Guide to compare the Saudi clock with GDPR, the UK and other regimes.
Transfers outside the Kingdom
- Purpose test: the Transfer Regulation permits transfers for listed purposes, including enabling the controller's activities such as central management, delivering a service to the data subject and scientific research.
- Minimum data: transfers are limited to the minimum necessary (Transfer Regulation Article 2).
- Adequacy: SDAIA assesses other jurisdictions and reviews assessments at least every four years.
- Safeguards (Article 5): binding common rules, SDAIA standard contractual clauses, certification and binding codes of conduct. Using one of these exempts the controller from some general transfer conditions, but SDAIA can withdraw the exemption if safeguards prove inadequate.
- Exceptions (Article 6): contract performance with the data subject and vital interests of an unreachable data subject, plus national security and crime grounds for public entities. Consent and legal claims are not exceptions, unlike GDPR.
- Risk assessment (Article 7): required before transfers relying on Articles 5 or 6 and before continuous or large-scale transfers of sensitive data. It covers purpose and legal basis, the processing, the safeguards, the measures used, potential material or moral effects and mitigations.
- Stop condition: transfers must stop and be reassessed if they affect national security or vital interests, carry high privacy risk, or safeguards are no longer enforceable.
See the International Data Transfers Map for how Saudi mechanisms line up with GDPR SCCs and other regimes.
Timeline and current status
| Date | Event |
|---|---|
| 16 September 2021 | PDPL issued by Royal Decree M/19 |
| 27 March 2023 | Amendments by Royal Decree M/148 |
| 2023 | Final Implementing Regulation and Transfer Regulation issued by SDAIA after April 2023 consultation drafts |
| 14 September 2023 | PDPL enters into force with a one-year transition |
| August to September 2024 | SDAIA issues DPO appointment rules, National Register rules, SCCs and BCR guidance; Transfer Regulation updated 1 September 2024 |
| 14 September 2024 | Transition ends; the PDPL framework is fully enforceable |
| 6 October to 5 November 2026 | Public consultation on draft amendments to the Implementing Regulation via the Istitlaa platform |
The October 2026 draft, as summarised by Clyde and Co, would if adopted take effect 60 days after publication in the Official Gazette. Its main proposals are:
- Breach reporting without a harm test: notify SDAIA of breaches, damage or unauthorised access within 72 hours of awareness regardless of likely harm; individual notification would keep the harm test.
- Storage in the Kingdom: a new requirement for controllers to store personal data in Saudi Arabia, with transfers abroad still possible under the PDPL.
- Wider DPIA triggers: minors, large-scale monitoring, emerging technologies and automated decisions affecting individuals.
- Wider DPO duty: all public entities providing services involving personal data, plus large-scale monitoring and sensitive-data controllers.
- Deadlines: unanswered data subject requests deemed rejected after 30 days; responses to SDAIA requests due within 20 business days.
Treat these as proposals until SDAIA publishes the final text. Building to the stricter breach trigger now costs little and avoids a scramble later.
Enforcement and penalties
| Sanction | Scope |
|---|---|
| Fine up to SAR 5 million | Violations of the law or regulations; may be doubled for repeat violations |
| Up to two years' imprisonment and/or a fine up to SAR 3 million | Disclosing or publishing sensitive data with intent to harm the data subject or obtain a personal benefit |
| Warnings | Issued by the enforcement committees |
| Seizure and confiscation | SDAIA may seize tools used in a violation pending decision; courts may confiscate gains |
| Compensation | Individuals suffering material or moral damage can seek compensation in the courts |
Clyde and Co reports that committees are now reviewing alleged violations and issuing enforcement decisions. SDAIA's knowledge centre also offers a mechanism to request a legal opinion, which is useful for novel processing such as AI deployments.
What it means for AI agents and non-human identities
The PDPL does not mention AI agents, but every agent, pipeline and integration that reads personal data is processing under the law, and the credentials behind them decide who can reach that data.
- Automated decisions: processing based solely on automated means needs explicit consent and appears in the DPIA triggers. An AI agent that approves, rejects or prices for customers in the Kingdom needs a DPIA and a documented basis. See the AI and Privacy Guide.
- Agents as transfer paths: an agent calling a model API hosted outside the Kingdom transfers personal data. Record the purpose, apply minimum-data rules (prompt redaction), and cover the provider with SCCs and a transfer risk assessment.
- Records of processing: list agents, service accounts and integrations as processing activities with owners, purposes and data categories. See the Data Mapping and ROPA Guide.
- Breach scope: a leaked API key or OAuth token with access to Saudi customer data is a potential notifiable breach. Logging which identity read which records is what lets you count affected individuals inside 72 hours.
- Least privilege: scope agent and service credentials to the data the purpose needs, which is also how you evidence the minimum necessary principle. See the Non-Human Identity (NHI) Guide and the Secrets Management Guide.
Compliance steps
- Confirm scope: identify Saudi data subjects across all systems, including those operated outside the Kingdom.
- Register and appoint: check the National Register criteria and DPO rules; register on the National Data Governance Platform and file DPO details where required.
- Build the record of processing: use SDAIA's records guideline; include non-human identities, AI agents and third-party processors.
- Fix lawful bases: separate consent per purpose, explicit consent for sensitive, credit and solely automated processing, documented legitimate interest assessments.
- Run DPIAs for the listed triggers and share copies with processors.
- Map transfers: list every destination, purpose and mechanism; sign SDAIA SCCs; complete Article 7 risk assessments; check data residency needs of SAMA, CST or NCA cloud controls.
- Rehearse breach response: a 72-hour tabletop covering SDAIA, sector regulators and individual notification, with a pre-approved notice template. Test once using the proposed no-harm-threshold trigger.
- Roll back safely: if a new control (for example prompt redaction or a transfer block) breaks a business process, revert it in a pilot ring, log the decision and the interim risk acceptance signed by the DPO.
Framework mapping
| PDPL duty | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal requirements and scope | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| Records of processing | ID.AM-07 | PT-3 | A.5.34 |
| DPIA | GV.OC-03 | RA-8 | A.5.34 |
| Security of processing | PR.DS-01, PR.DS-02, PR.AA-05 | AC-6, IA-4, AU-2 | A.8.24, A.5.15 |
| Breach notification | RS.CO-02 | IR-6, IR-8 | A.5.24, A.5.26 |
| Processors and transfers | GV.OC-03 | SA-9 | A.5.14, A.5.20 |
| Retention and destruction | PR.DS-01 | SI-12 | A.8.10 |
Measuring it
- Time to notify: hours from awareness to SDAIA notification in exercises and real incidents (target under 72).
- ROPA coverage: percentage of systems, agents and integrations processing Saudi data that appear in the record.
- Transfer coverage: percentage of cross-border flows with a documented mechanism and risk assessment.
- DSAR timeliness: share of requests closed within 30 days.
- Credential scope: share of non-human identities with access to personal data that have a named owner and reviewed scope.
Common failure patterns
- Assuming no local entity means no PDPL: extraterritorial scope catches foreign providers serving people in the Kingdom.
- Relying on consent for transfers: consent is not a transfer exception under the Saudi Transfer Regulation, unlike GDPR Article 49.
- Counting affected individuals too late: without access logs per identity, teams miss the 72-hour window. Exposed credentials are a common start point, as in the United Nations Breach, where exposed Git credentials opened staff records.
- Treating the DPO rules as optional: core-activity tests catch many SaaS and fintech firms whose product is the processing.
- Forgetting sector overlays: SAMA, CST and NCA requirements on residency and incident reporting apply in addition to the PDPL.
- Ignoring the draft: building only to the harm-based breach trigger risks rework if the October 2026 amendments are adopted.
Practitioner checklist
- Confirm whether you process data of individuals in Saudi Arabia, wherever the systems run.
- Check National Register and DPO criteria and complete registration on the National Data Governance Platform.
- Maintain a record of processing that includes AI agents, service accounts and processors, retained five years after processing ends.
- Document lawful bases per purpose, with explicit consent for sensitive, credit and solely automated processing.
- Complete DPIAs for the listed triggers and share them with processors.
- Inventory cross-border transfers, including model and SaaS APIs, with SCCs or other safeguards and Article 7 risk assessments.
- Run a 72-hour breach exercise covering SDAIA, sector regulators and individuals.
- Scope and log every credential that can read personal data, and rotate any found exposed.
- Track the October 2026 Implementing Regulation amendments and the final Gazette text.
Standards and references
- SDAIA: Personal Data Protection knowledge centre (PDPL, Implementing Regulation, Transfer Regulation, rules and guidelines)
- Qanoniah: Rules for Appointing a Personal Data Protection Officer (SDAIA text)
- Clyde and Co: The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL
- Latham and Watkins: Saudi Arabia's data protection law enters into force
- CMS: New SDAIA rules and guidelines published as KSA's personal data protection framework is now enforceable
- Akin: Saudi Arabia's PDPL and Implementing Regulations, key obligations
- CMS: Expert guide to data protection and cyber security laws, Saudi Arabia
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: UAE PDPL Guide · Saudi NCA Essential Cybersecurity Controls Guide · Global Privacy Regulatory Map · Breach Notification Laws by Country Guide. This guide summarises the Saudi Personal Data Protection Law and its regulations as at October 2026 and is not legal advice.