Bahrain, Saudi Arabia
Saudi PDPL Compliance Services
Practical compliance with the Personal Data Protection Law, its Implementing Regulation and SDAIA’s rules, with a team based in Dammam: from mapping your personal data to registration, breach readiness and cross-border transfers.
The Saudi PDPL at a glance
- M/19
- Royal Decree of 9/2/1443H that issued the law, amended by Royal Decree M/148 of 5/9/1444H
- 72 hours
- to notify SDAIA of a personal data breach that could cause harm
- 30 days
- to respond to a data subject’s request, extendable by 30 more with notice
- SAR 5 million
- maximum fine for a violation, which can be doubled for a repeat offence
Who the PDPL applies to
Organisations in the Kingdom
Public and private entities that process personal data in Saudi Arabia.
Organisations abroad
Any party outside the Kingdom that processes personal data of individuals residing in the Kingdom, by any means.
Individuals
People processing personal data for purposes beyond personal or family use.
What the law requires
The core obligations for controllers under the Personal Data Protection Law, its Implementing Regulation and SDAIA’s rules.
A lawful basis
Consent is the default basis, and it can be withdrawn at any time. The law sets limited exceptions, including legitimate interest, which needs a documented assessment and cannot cover sensitive data (Articles 5–6, Implementing Regulation Article 16).
Privacy policy and notices
Make a privacy policy available before collecting personal data, and tell people why and how it is collected (Articles 12–13).
Records of processing
Keep records of processing activities, retained for five years after a processing activity ends (Article 31, Implementing Regulation Article 33).
Registration with SDAIA
Public entities, and organisations whose main activity is processing personal data or that process sensitive data, must register on the National Data Governance Platform.
A Data Protection Officer
Appoint a DPO when you are a public entity processing on a large scale, regularly and systematically monitor people, or process sensitive data as a core activity (Implementing Regulation Article 32).
Impact assessments
Assess the impact before processing sensitive data, linking datasets, large-scale processing or monitoring, new technologies or automated decisions (Article 22, Implementing Regulation Article 25).
Security and breach notice
Protect personal data and notify SDAIA within 72 hours of becoming aware of a breach that could cause harm, then tell affected people without undue delay (Article 20, Implementing Regulation Article 24).
Cross-border transfers
Transfer data abroad only where it does not harm national security, with adequate protection and the minimum data needed, using SDAIA’s adequacy list or safeguards such as standard contractual clauses (Article 29, Transfer Regulation).
Rights you must be ready to honour
Individuals can exercise these rights against your organisation, and the Implementing Regulation sets how quickly you must respond.
| Topic | What the individual can do | How quickly you must respond |
|---|---|---|
| Be informed | What the individual can do: Know the legal basis and purpose of collecting their data (Article 4) | How quickly you must respond: Before or when the data is collected |
| Access | What the individual can do: Access their personal data held by the controller (Article 4) | How quickly you must respond: Within 30 days, extendable by 30 more |
| Obtain a copy | What the individual can do: Receive their data in a readable and clear format (Article 4) | How quickly you must respond: Within 30 days, extendable by 30 more |
| Correct | What the individual can do: Have their data corrected, completed or updated (Article 4) | How quickly you must respond: Within 30 days, extendable by 30 more |
| Destroy | What the individual can do: Have data that is no longer needed destroyed (Article 4) | How quickly you must respond: Within 30 days, extendable by 30 more |
| Withdraw consent | What the individual can do: Withdraw consent at any time (Article 5) | How quickly you must respond: As soon as it is withdrawn |
Individuals can also complain to SDAIA and claim compensation for material or moral damage through the courts (Articles 34 and 40).
What non-compliance can cost
The law combines criminal penalties with fines imposed by an SDAIA committee.
SAR 3 million
Maximum fine, with up to two years’ imprisonment, for disclosing or publishing sensitive data to harm someone or for personal benefit.
Source: Article 35
SAR 5 million
Maximum fine for other violations of the law or its regulations, or a warning instead.
Source: Article 36
2×
Fines can be doubled for a repeat violation, up to twice the maximum.
Source: Articles 35–36
Published
Courts can order confiscation of funds obtained through a violation and publication of the judgment at the violator’s expense.
Source: Article 38
How we take you to compliance
- 01
Scoping and data inventory
We map what personal data you hold, where it flows and who receives it, inside and outside the Kingdom.
- 02
Gap assessment
We measure your practices against the law, the Implementing Regulation and SDAIA’s rules.
- 03
Registration and DPO
We confirm whether you must register with SDAIA or appoint a DPO, and prepare what is needed.
- 04
Remediation
Privacy policy and notices, records of processing, impact assessments, transfer safeguards and security measures.
- 05
Ongoing compliance
Breach readiness, rights handling and monitoring as your processing changes.
The Saudi Data & AI Authority (SDAIA) is the competent authority. It oversees how the law and its regulations are applied, keeps the national register of controllers and receives breach notifications and complaints.
Yes. It covers processing of personal data of individuals residing in the Kingdom by any means from any party outside the Kingdom.
Data revealing racial or ethnic origin, religious, intellectual or political belief, criminal and security convictions, biometric or genetic data, health data, and data indicating that one or both parents are unknown.
Notify SDAIA within 72 hours of becoming aware of an incident that could cause harm, and tell the affected individuals without undue delay where it may damage their data or rights.
You must appoint one if you are a public entity processing personal data on a large scale, if your core activities need regular and systematic monitoring of individuals, or if your core activities involve processing sensitive data. The DPO can be an employee or an external contractor.
Yes, under conditions. The transfer must not harm national security, the destination must offer adequate protection, and only the minimum data needed may be sent. SDAIA publishes an adequacy list, and other transfers can rely on safeguards such as standard contractual clauses, sometimes with a risk assessment first.
They are separate laws with different regulators, deadlines and penalties. Bahrain’s is Law No. 30 of 2018. If you operate in both countries, we can help with each.
Talk to our team in Saudi Arabia
VirtuThinko Company works with organisations across the Kingdom from our office in Dammam. Tell us how you use personal data and we will show you where you stand against the PDPL.