PrivacyTerrainStructured privacy law intelligence

mea

Saudi Arabia

Saudi Arabia's PDPL is a fast-evolving regime with strong emphasis on lawful processing, security, and transfers.

Primary lawPersonal Data Protection Law
Statusin-force
Last reviewed17/04/2026
Coverage qualityseeded-expanded
Confidencemedium
Primary sources1
Secondary sources1
Last checkedUnknown
Freshnessunknown
Review prioritymedium

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Needs a closer pass on implementing regulations and transfer restrictions.

Breach

Breach deadline (hours)
72
Breach notification required
Yes

Marketing

Cookie consent rule
Tracking and advertising analysis is influenced by consent expectations and wider Saudi digital regulation practice.

Transfers

Cross-border transfer restricted
Yes
Data localization required
Yes

Governance

DPO required
Yes
Impact assessment required
Yes
Records of processing required
Yes

Identity

Effective date
2023-09-14
Effective status
in-force
Last amended
2023-09-14
Law status
active

Scope

Extraterritorial application
Yes
Private sector coverage
Applies broadly to controllers in the private sector.
Public sector coverage
Public entities are covered subject to sector-specific treatment and national security considerations.
Territorial scope
Applies to processing in Saudi Arabia and, in certain circumstances, to processing of data subjects residing in Saudi Arabia from abroad.

Legal Basis

Legal bases
consent, contract, legal obligation, public interest, legitimate interests
Requires legal basis
Yes

Enforcement

Maximum fine
The PDPL allows significant penalties and, in serious cases, criminal exposure for unlawful disclosures.
Private right of action
Yes
Regulator or enforcement authority summary
Centralized Saudi regulatory structure

Definitions

Personal data definition
Personal data means any data, regardless of its source or form, that may lead to identifying an individual specifically or indirectly.
Sensitive data recognized
Yes

Rights

Right of access
Yes
Right to appeal
Yes
Right to deletion
Yes
Right to erasure or delete summary
Deletion / destruction rights
Right to object
Yes
Right to portability
Yes
Right to rectification or correction summary
Correction right

Official sources

Recent change workflow