PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Needs a closer pass on implementing regulations and transfer restrictions.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to processing in Saudi Arabia and, in certain circumstances, to processing of data subjects residing in Saudi Arabia from abroad.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryCentralized Saudi regulatory structure1 primary • Reviewed 17/04/2026

Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Effective date: 2023-09-14Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Last amended: 2023-09-14Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to processing in Saudi Arabia and, in certain circumstances, to processing of data subjects residing in Saudi Arabia from abroad.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies broadly to controllers in the private sector.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Public sector coverage: Public entities are covered subject to sector-specific treatment and national security considerations.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal data means any data, regardless of its source or form, that may lead to identifying an individual specifically or indirectly.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Sensitive data recognized: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: consent, contract, legal obligation, public interest, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Requires legal basis: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to object: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to portability: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: Deletion / destruction rightsSupport: 1 primary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary)Note: Saudi Arabia is better summarized through deletion and destruction language than imported shorthand alone.
Right to rectification or correction summary: Correction rightSupport: 1 primary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary)Note: Saudi Arabia includes correction-oriented rights within its national privacy framework.

Breach

Breach deadline (hours): 72Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Governance

DPO required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Impact assessment required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Records of processing required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: The PDPL allows significant penalties and, in serious cases, criminal exposure for unlawful disclosures.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private right of action: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Centralized Saudi regulatory structureSupport: 1 primary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary)Note: Saudi Arabia is better summarized through its centralized regulatory structure than a simplistic single-agency label.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Data localization required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Tracking and advertising analysis is influenced by consent expectations and wider Saudi digital regulation practice.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Saudi PDPL text (primary); SDAIA guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Official sources

Saudi PDPL textPrimary official law • en • html
SDAIA guidanceSecondary official material • en • html

Saudi Arabia