Saudi Arabia’s PDPL is the Kingdom of Saudi Arabia’s fist personal data protection law. The PDPL aims to safeguard personal data, ensure privacy, and establish rules for how data can be collected, stored, and shared.

The law is overseen by a competent government authority that ensures compliance, investigates violations, and imposes penalties. The Saudi Data and Artificial Intelligence Authority (SDAIA) has been designated as the competent authority.

The law covers all personal data that can lead to identifying an individual, including names, identification numbers, contact details, addresses and sensitive information like health data, biometric data, license numbers, bank numbers, etc.

The PDPL enshrines a number of rights to data subjects including, the right to access data, right to information, right to correction, completion and updating personal data and the right to request destruction of data.

Generally, businesses need your consent, but exceptions apply for public interest, legal obligations, or when the data is already public.

PDPL imposes stricter requirements for processing sensitive data, including obtaining explicit consent from data subjects, implementing robust security measures, and ensuring the data is only processed for legitimate, specific purposes. Controllers must also conduct risk assessments when handling sensitive data, particularly for cross-border transfers or large-scale processing, to mitigate potential risks to data subjects.

Yes, personal data can be shared outside Saudi Arabia under the PDPL if it meets specific conditions, such as ensuring an adequate level of protection in the receiving country or implementing safeguards like binding rules, standard contractual clauses, or accreditation. Exemptions exist for certain cases, but transfers must not compromise national security, data subject rights, or privacy standards.

Non-compliance can lead to fines up to SAR 5 million, and even imprisonment for serious violations.

The Saudi PDPL mandates organizations to notify SDAIA and affected individuals promptly in case of data breaches, particularly those causing harm.

Organizations must use technical and organizational measures, such as encryption and access controls, to secure personal data.