Saudi PDPL for foreign operators
If you process personal data about people in Saudi Arabia, the PDPL applies — whether or not you have an entity there. Fully enforced since September 2024, with SDAIA now issuing penalties, the regulator is active and the cross-border transfer rules are where most foreign operators are exposed.
Saudi Arabia's first comprehensive data law — now enforced
The Personal Data Protection Law (PDPL) was issued by Royal Decree No. M/19 dated 9/2/1443H (16 September 2021) and amended by Royal Decree No. M/148 dated 5/9/1444H (27 March 2023). It entered into force on 14 September 2023, and the one-year grace period ended on 14 September 2024 — since when it has been in full, active enforcement. Its Implementing Regulations and the separate Personal Data Transfer Regulations were published alongside it. The regulator is the Saudi Data & Artificial Intelligence Authority (SDAIA), which issued the regulations and runs enforcement through dedicated Committees for Reviewing Violations.
The enforcement phase is not theoretical. In January 2026, SDAIA announced that its committees had issued 48 decisions during 2025 confirming violations and imposing penalties — for processing without a legal basis, unauthorised disclosure, inadequate security measures and marketing without consent. A compliance gap is now an exposure, not a future risk, and there is no size or revenue threshold: public and private, domestic and foreign, are all in scope.
It reaches you wherever you sit
The PDPL applies to the processing of the personal data of individuals residing in Saudi Arabia, including processing carried out by entities located outside the Kingdom. That extraterritorial reach is broader than many foreign operators expect: a company with Saudi customers or staff is caught even without a local entity. It is tempting to treat the PDPL as “GDPR with a Saudi label,” and the two do rhyme — but the differences are sharp enough to trip a team that assumes equivalence.
The lawful bases for processing are narrower, and the cross-border transfer regime is more prescriptive — it requires an adequacy determination by SDAIA or approved safeguards plus a documented transfer risk assessment, not a self-assessed reliance on standard clauses. Sensitive personal data carries stricter rules and the possibility of criminal liability. A single “global” privacy policy rarely satisfies the PDPL without Saudi-specific layers.
The sharpest difference, and the usual gap
For international businesses, cross-border transfers are the most operationally complex part of the PDPL — and the one most likely to be non-compliant. Data may leave the Kingdom only when the transfer is necessary and lawful and one of the conditions is met: the destination country has been determined by SDAIA to provide an adequate level of protection, or the transfer is made under approved safeguards (such as standard contractual clauses or binding corporate rules). Outside the adequacy route, the exporter must complete a documented Transfer Risk Assessment under the Personal Data Transfer Regulations, and SDAIA must not have prohibited the specific transfer.
Sensitive and health data are more heavily restricted, requiring a transfer risk assessment regardless of volume. In practice, foreign operators resolve this one of three ways: host the data in-region (for example in Saudi or nearby data-centre regions), obtain the right transfer basis and documentation under the Transfer Regulations, or restructure processing to minimise the personal data leaving the Kingdom. The one option that is not available is to assume EU-style standard clauses alone will carry a Saudi transfer.
The operational checklist
Register & appoint
Register as a controller on SDAIA's national platform where required, and appoint a Data Protection Officer where the Implementing Regulations' criteria are met.
Document
A clear privacy notice, records of processing, impact assessments on higher-risk processing, and processor/vendor agreements — the controller stays accountable for its processors.
Transfer mechanism
A compliant cross-border basis — adequacy or safeguards — with a documented Transfer Risk Assessment for data leaving the Kingdom.
Breach notification
Notify SDAIA of breaches within the required timeframe, and be able to evidence your security measures.
A tiered regime, actively applied
The penalty regime is tiered and, as of 2026, actively applied by SDAIA's Committees for Reviewing Violations under published rules of procedure. Under Article 36, general violations attract a warning or a fine of up to SAR 5 million per violation, doubled for repeat offences; the committees can also order remediation, require publication of the penalty, and suspend processing activities.
Beyond SDAIA's administrative and criminal penalties, any person who suffers material or moral harm from a PDPL violation has a right to claim compensation before the competent court. The exposure is therefore regulatory and civil at once.
Two regimes if you run a GCC structure
Groups running a Bahrain → Saudi structure manage two data-protection regimes at once. Bahrain has its own PDPL, and while the two rhyme, they are not identical — different authorities, different transfer mechanics, different notification rules. A single “GCC privacy policy” usually needs jurisdiction-specific layers, and the data flows between the Bahraini and Saudi entities are themselves cross-border transfers that have to be papered correctly under each regime. For a corporate-services or holding structure that moves client and employee data across the causeway, mapping those flows is not optional housekeeping — it is where the first compliance gap usually hides.
Questions we get asked first
Does the PDPL apply to a foreign company with no Saudi entity?
Yes, if you process the personal data of individuals residing in Saudi Arabia. Its extraterritorial reach is broader than the GDPR's and captures entities located outside the Kingdom.
When did it become enforceable?
It entered into force on 14 September 2023 and reached full enforcement on 14 September 2024, after the one-year grace period. It is enforced by SDAIA, which issued 48 enforcement decisions during 2025.
How is it different from GDPR?
Chiefly the lawful bases are narrower and the cross-border transfer regime is more prescriptive — requiring a SDAIA adequacy determination or approved safeguards plus a documented Transfer Risk Assessment, not self-assessed standard clauses. Sensitive data carries stricter rules and possible criminal liability.
What are the penalties?
Administrative fines of up to SAR 5 million per violation, doubled for repeats; up to one year's imprisonment or a SAR 1 million fine for illegal cross-border transfers; and criminal penalties for unlawful disclosure of sensitive data. SDAIA can also suspend processing and publish decisions, and individuals can claim compensation.
How do cross-border transfers work?
Data may leave the Kingdom only to a country SDAIA deems adequate, or under approved safeguards with a documented Transfer Risk Assessment. Sensitive and health data require a risk assessment regardless of volume. In-region hosting is a common solution.
Does it overlap with Bahrain's PDPL?
They rhyme but differ. A Bahrain-to-Saudi group usually needs jurisdiction-specific layers rather than one GCC policy, and the data flows between the two entities are cross-border transfers under each regime.
Map the data, then the transfer
If you touch Saudi personal data, map what you collect, where it flows and on what basis. The transfer question — how Saudi data reaches your systems abroad — is the one most likely to trip a foreign operator, and with SDAIA now issuing penalties, the cost of getting it wrong is real and immediate. Register, document, fix the transfer basis, and — if you run a GCC structure — reconcile the Saudi and Bahraini regimes rather than papering over them with a single global policy.
Processing Saudi personal data?
We map your data flows, fix the cross-border transfer gap, and put a PDPL-compliant framework in place — alongside Bahrain if you run both.
Speak to an Advisor →Related reading
This article is general information, current as of 2026, and is not legal or tax advice for any specific situation. Confirm current rules and official Arabic texts with the relevant authority before acting.