Saudi Arabia’s Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024 and applies to entities outside the Kingdom that process residents’ data. SDAIA has started issuing enforcement decisions, and the transfer regulation was re-issued in 2024.
Cybersecurity is governed by the National Cybersecurity Authority (NCA), whose controls apply mainly to government and critical infrastructure but increasingly reach the private sector through vendor requirements and new frameworks.
- Core data law
- Personal Data Protection Law (PDPL), amended 2023
- Regulator
- SDAIA (Saudi Data & AI Authority)
- Enforceable since
- 14 Sep 2024
- Penalties
- Up to SAR 5 million per violation, doubled for repeat offences
- Cyber
- NCA Essential Cybersecurity Controls; new private-sector controls
- Transfers
- Transfer regulation re-issued Sep 2024
Who needs to comply
Any startup processing personal data of Saudi residents
The PDPL applies inside the Kingdom and to processing abroad of residents’ data.
Vendors to government and critical infrastructure
NCA controls and data classification rules flow down through contracts.
Fintech
SAMA rules on cybersecurity, cloud and outsourcing apply to regulated entities and their vendors.
The laws, in detail
01Personal Data Protection Law (PDPL) & Implementing Regulations
Lawful bases, notices, rights, security, breach notification, records, DPO and transfers.
When it applies
Processing personal data in the Kingdom, or of residents by entities outside it.
What you must do
- Lawful basis, including consent and legitimate interest (not for sensitive data)
- Privacy notice before collection
- Records of processing; DPO in specified cases
- Notify SDAIA of breaches within 72 hours where required
- Transfer only under adequacy or appropriate safeguards and a risk assessment
- Register on SDAIA’s national data governance platform where required
Regulator
SDAIA
Penalties
Warnings or fines up to SAR 5 million, doubled for repeat violations; disclosing sensitive data with intent to harm can carry imprisonment and fines.
02NCA cybersecurity controls
Essential Cybersecurity Controls (ECC) and private-sector frameworks.
When it applies
Government entities, critical infrastructure operators and, increasingly, large private entities and vendors.
What you must do
- Cybersecurity governance and risk management
- Incident handling
- Third-party and cloud security
Regulator
National Cybersecurity Authority
Penalties
Enforcement under the NCA framework; contractual consequences for vendors.
03Sector rules: SAMA, health
Financial-sector cybersecurity, cloud and outsourcing; health data.
When it applies
Regulated entities and their technology providers.
What you must do
- SAMA cybersecurity framework and cloud rules
- Health data localisation and confidentiality
Regulator
SAMA; Ministry of Health
Penalties
Regulatory action.
04E-Commerce Law (2019)
Online sales disclosures, consumer rights and e-commerce advertising.
When it applies
Businesses selling to consumers in Saudi Arabia online.
What you must do
- Disclose business identity and registration
- Clear pricing, terms and cancellation rights
- Protect customer data collected in e-commerce
Regulator
Ministry of Commerce
Penalties
Fines up to SAR 1 million and suspension.
05Cloud Computing Regulatory Framework (CST)
Registration and duties of cloud service providers, and classification of customer content.
When it applies
Cloud service providers serving customers in Saudi Arabia.
What you must do
- Register with CST where required
- Incident notification and data protection duties
- Respect data residency for regulated content
Regulator
Communications, Space and Technology Commission
Penalties
Regulatory sanctions.
Compliance checklist
01 · Before you launch
- Write an Arabic and English privacy notice
- Map processing and lawful bases
- Plan transfers under the 2024 transfer regulation
- Check sector licensing
02 · At launch
- Records of processing
- 72-hour breach process
- DPO where required
- Registration on the national platform where required
03 · As you scale
- NCA controls for government and CNI customers
- Transfer risk assessments
- Track SDAIA enforcement decisions
Key dates
- Sep 2023PDPL in force (one-year grace period)
- 1 Sep 2024Amended transfer regulation
- 14 Sep 2024PDPL fully enforceable
Common mistakes
- Reusing a GDPR transfer approach without a Saudi risk assessment
- English-only notices
- Assuming legitimate interest covers sensitive data
FAQs
Does the PDPL apply to companies outside Saudi Arabia?
Yes, when they process personal data of residents of the Kingdom.
Is there an adequacy list?
Commentators report that a list of adequate countries has not been confirmed, so most transfers rely on safeguards and assessments.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.