Data protection & privacy law in Saudi Arabia (2026)

Legal framework

Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 (2021), amended by Royal Decree No. M/148 (2023); enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA). Supplemented by the Implementing Regulations and the Regulation on Personal Data Transfer Outside the Kingdom.

Key points: data & privacy in Saudi Arabia

1. 01Comprehensive law in force

   The PDPL (Royal Decree M/19 of 2021, amended by M/148 of 2023) and its Implementing Regulations came into force on 14 September 2023; the one-year grace period ended 14 September 2024, after which all organizations processing personal data in the Kingdom must be fully compliant.

   sdaia.gov.sa morganlewis.com

2. 02Supervisory authority

   The Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulator overseeing and enforcing the PDPL, issuing guidance (DPO appointment, privacy notices, data destruction/anonymization) and operating violation-review committees.

   sdaia.gov.sa dgp.sdaia.gov.sa

3. 03Scope and extraterritoriality

   The law applies to any processing of personal data of individuals that occurs within the Kingdom, and to processing by entities located outside the Kingdom of personal data of individuals residing in Saudi Arabia.

   sdaia.gov.sa dlapiperdataprotection.com

4. 04Data subject rights

   Individuals have GDPR-style rights including to be informed, access, rectification, erasure, data portability, objection, and to lodge complaints with SDAIA, plus the right to be notified of breaches posing high risk.

   dgp.sdaia.gov.sa dlapiperdataprotection.com

5. 05Cross-border transfers

   A dedicated Regulation on Personal Data Transfer Outside the Kingdom (Article 29), updated 1 September 2024, governs transfers via adequacy assessments, standard contractual clauses, binding common rules, and certificates; controllers must conduct transfer risk assessments, with 2025 guidance issued on these.

   dgp.sdaia.gov.sa scc-pdpl.sdaia.gov.sa

6. 06Obligations, breach notice, and penalties

   Core obligations include lawful basis, purpose limitation, security, accountability, DPO appointment and DPIAs; breaches must be notified to SDAIA within 72 hours. Fines reach up to SAR 5 million per violation (doubled for repeat offenses), and unlawful disclosure of sensitive data can carry imprisonment up to 2 years and/or fines up to SAR 3 million.

   sdaia.gov.sa aoshearman.com

Timeline of decisions

1. 1 Mar 2026Enforcement
   SDAIA Enters Active PDPL Enforcement Phase

   SDAIA's quasi-judicial enforcement committees began issuing binding decisions including warnings, fines up to SAR 5 million, and remediation orders against non-compliant organisations. Signals the definitive end of the post-enactment tolerance period.

   Clyde & Co

2. 1 Jan 2025Enforcement
   SDAIA Issues 48 PDPL Violation Decisions, First Substantive Enforcement Wave

   SDAIA's specialised committees announced 48 adjudication decisions against organisations for PDPL violations covering unlawful data collection, inadequate security controls, and unsolicited marketing without prior consent, establishing enforcement precedents across retail, telecoms, and financial services.

   IAPP

3. 14 Sept 2024Law · official
   PDPL Grace Period Ends, Full Enforcement Begins

   The one-year PDPL transition period expired on 14 September 2024, making the Personal Data Protection Law fully enforceable against all organisations, including foreign entities processing Saudi residents' data. Active supervisory mechanisms, fines up to SAR 5 million, and criminal liability for wilful breaches became operative from this date.

   SDAIA

4. 14 Sept 2024Enforcement · official
   PDPL Fully Enforceable; SDAIA Issues 48 Penalty Decisions

   After a three-year phased transition, Saudi Arabia's Personal Data Protection Law became fully enforceable on 14 September 2024. SDAIA's enforcement committees issued 48 decisions within the first enforcement year against organisations for unlawful data collection, marketing without consent, and inadequate security controls, with fines up to SAR 5 million per violation.

   Saudi Data and Artificial Intelligence Authority (SDAIA)

5. 14 Sept 2024Decision
   PDPL One-Year Compliance Grace Period Expires, Full Enforcement Effective

   The transition period ended, making all PDPL obligations, including breach notification, data-subject rights, and consent requirements, immediately and fully enforceable against all public and private entities processing personal data in the Kingdom.

   Morgan Lewis

6. 1 Aug 2024Law
   SDAIA Issues Regulation on Cross-Border Personal Data Transfers

   SDAIA published a standalone regulation governing personal data transfers outside Saudi Arabia, requiring either an SDAIA adequacy determination for the destination country or explicit SDAIA authorisation, and mandating risk assessments for large-scale or continuous cross-border transfers.

   Securiti / SDAIA

7. 14 Sept 2023Law · official
   PDPL and Implementing Regulations Enter Into Force, One-Year Grace Period Begins

   Saudi Arabia's first comprehensive data protection law took effect alongside its implementing regulations; a one-year grace period until 14 September 2024 was granted for full compliance while SDAIA activated its supervisory powers and breach-notification registry.

   SDAIA

8. 14 Sept 2023Law · official
   Personal Data Protection Law (PDPL) Enters into Force

   Saudi Arabia's PDPL (originally enacted September 2021, amended by Royal Decree No. M/148 in March 2023) became fully enforceable, imposing cybersecurity obligations including encryption, access controls, 72-hour breach notification to SDAIA, and data protection impact assessments, creating GDPR-comparable data-security duties on all controllers.

   Saudi Government National Portal

9. 7 Sept 2023Guidance
   SDAIA Publishes PDPL Implementing Regulations and Preliminary Transfer Rules

   One week before enforcement, SDAIA issued detailed rules setting a 72-hour breach notification window, 30-day data-subject request deadlines, requirements for data-protection impact assessments (DPIAs), and a preliminary cross-border data transfer framework.

   Clyde & Co / SDAIA

10. 27 Mar 2023Law
    PDPL Amended by Royal Decree M/148, 27 Substantive Revisions

    The Council of Ministers approved 27 amendments that narrowed the sensitive-data definition, replaced 'written consent' with 'clear consent', expanded legitimate-interest processing grounds, and granted SDAIA investigators explicit confiscation powers, while confirming the September 2023 enforcement date.

    Akin Gump / Council of Ministers

11. 30 Aug 2019Law · official
    SDAIA Established, National Data & AI Authority Created by Royal Decree

    A Royal Decree created the Saudi Data & Artificial Intelligence Authority (SDAIA) together with the National Data Management Office (NDMO) and National Centre for AI (NCAI), making SDAIA the de facto data governance regulator and the body that would later administer the PDPL.

    Saudi National Portal

12. 26 Mar 2007Law · official
    Anti-Cyber Crime Law Enacted, Royal Decree M/17

    Saudi Arabia's first law addressing digital privacy, criminalising unauthorised computer access, interception of personal data, and misuse of information networks; carried penalties up to one year imprisonment and SAR 500,000 in fines. Served as the primary pre-PDPL privacy framework for 15 years.

    WIPO Lex

Sources

1. 1.sdaia.gov.sa/en/Research/Pages/DataProtection.aspx
2. 2.sdaia.gov.sa/en/SDAIA/about/Documents/ImplementingRegulation.pdf
3. 3.dgp.sdaia.gov.sa/wps/wcm/connect/f579bc32-fda8-47bd-bc6f-66b8cb77985c/ENG-Guide+to+the
4. 4.dgp.sdaia.gov.sa/wps/wcm/connect/e5bbede0-1119-4f70-b4ef-f043ce58d780/Regulation+on+Pe
5. 5.scc-pdpl.sdaia.gov.sa/wps/portal/comm/documentsguide/regulation-on-personal-data-transfer-o
6. 6.dlapiperdataprotection.com/?c=SA
7. 7.morganlewis.com/pubs/2024/09/saudi-arabia-personal-data-protection-law-transition-per
8. 8.aoshearman.com/en/insights/enforcement-of-the-saudi-personal-data-protection-law