If a Controller transfers your personal data outside Saudi Arabia without meeting legal conditions (i.e., no adequacy, safeguards like SCCs/BCRs, emergency exception, or SDAIA approval), this is considered an unlawful cross-border transfer. As per Article 36 of the PDPL: 

• They may face up to 1 year imprisonment and/or a fine of SAR 1 million (~USD 267,000) for this violation

Yes. The PDPL allows for enhanced sanctions under Article 36: 

• A repeat offense can result in doubling the fine, raising it up to SAR 2 million. 

• Importantly, the law does not limit the prescribed imprisonment term, allowing penalties to increase for ongoing or repeated non-compliance.

A violation occurs when a cross-border transfer is made without following the lawful pathways: 

• No adequate decision by SDAIA for the destination country. 

• No use of approved safeguards, such as Standard Contractual Clauses, Binding Corporate Rules, or accredited certification. 

• No presence of an emergency justification (e.g., for vital interests or health emergencies). 

• No required approvals or risk assessments conducted where mandated under the transfer regulations.