Saudi PDPL

PDPL stands for Personal Data Protection Law in Saudi Arabia. It regulates how personal data is collected, processed, and stored to protect individuals’ privacy.

Violating the Personal Data Protection Law (PDPL) in Saudi Arabia can lead to severe penalties, including: 

• Criminal Penalty (for unlawful data disclosure with intent to harm): 

• • Up to 2 years in prison 

• • Up to SAR 3 million fine 

• Administrative Penalties: 

• • Up to SAR 5 million fine (can be doubled for repeat violations) 

• • Public disclosure of violations at the violator’s expense 

• • Confiscation of unlawful gains 

• • Compensation claims allowed under civil liability provisions

Yes, Saudi Arabia’s Personal Data Protection Law (PDPL) included a grace period. 

• Initial Grace Period: The law was first issued in September 2021, with a one-year grace period provided to allow organizations to prepare for compliance. 

• Extension of Grace Period: The grace period was extended following amendments in 2023. Full enforcement of the PDPL began on September 14, 2024. 

The Saudi PDPL differs from GDPR in several key aspects: 

• Stricter rules on data transfer outside Saudi Arabia: Requires approval unless exempted. 

• More centralized enforcement: Primarily enforced through SDAIA. 

• Sector-specific exemptions: Some sector-specific exemptions may apply. 

The Saudi Personal Data Protection Law (PDPL) was fully implemented on September 14, 2024. 

• The law was initially issued in September 2021. 

• The amended law came into force on September 14, 2023, but full enforcement (including penalties and regulatory action) began after the grace period, on September 14, 2024. 

• The PDPL is enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA).