Scope and supervision under PDPL Saudi Arabia
The Saudi data protection law, PDPL, governs the processing of personal data of individuals in the Kingdom, including processing carried out from outside Saudi Arabia. The Saudi Data and Artificial Intelligence Authority, SDAIA, is the supervisory authority, and it has issued implementing regulations and separate rules covering transfers outside the Kingdom.
The regime is notable for how much detail sits in the implementing regulations rather than the law itself. Organisations that read only the primary law usually miss operational requirements such as record keeping content and assessment triggers.
Lawful bases under PDPL Saudi Arabia
Consent is a central basis, and the regulations set expectations for how it is obtained, recorded and withdrawn. The law also recognises other bases, including a legitimate interest basis that comes with conditions: it cannot be used for sensitive data, and the controller is expected to carry out and document an assessment weighing its interest against the individual's rights.
Treating legitimate interest as a default fallback is the single most common error we see. It is a documented, defensible judgement, not a box to tick.
- Consent, meeting the form and record keeping expectations in the regulations.
- Necessity for a contract with the data subject.
- Compliance with a legal obligation.
- Protection of vital interests, public health or public safety.
- Legitimate interest, supported by a documented assessment and excluded for sensitive data.
Cross border transfers under Saudi data protection law
Transfers of personal data outside the Kingdom are permitted for defined purposes and subject to conditions, including an assessment of the impact of the transfer and, where the destination does not offer an adequate level of protection, appropriate safeguards such as standard contractual clauses or binding common rules. The transfer must not prejudice national security or the vital interests of the Kingdom.
In practice this means a transfer register: for every flow leaving Saudi Arabia, the purpose, the destination, the safeguard relied on and the assessment behind it.
Records, assessments and registration under PDPL Saudi Arabia
Controllers are expected to maintain records of processing activities with specified content, and to carry out impact assessments for processing that presents higher risk, including new products and services involving personal data and processing of sensitive data. The regulatory framework also contemplates a national register of controllers, so organisations should track their registration position rather than assume it does not apply.
- Records of processing activities covering purposes, categories, recipients, transfers and retention.
- Impact assessments for higher risk processing, retained as evidence of the decision.
- A documented retention and destruction schedule tied to actual systems.
- Awareness of registration and notification obligations as they are brought into effect.
Breach reporting and data subject rights under PDPL Saudi Arabia
Controllers must notify SDAIA of a personal data breach within the timeframe set by the regulations after becoming aware of it, and must inform affected individuals where the breach may cause damage to their data or conflict with their rights. Because the reporting window is short, detection and escalation need to be tested rather than assumed.
Individuals hold rights to be informed, to access and obtain a copy of their data, to request correction and to request destruction. Requests must be handled within defined periods, so a tracked intake process matters as much as the policy behind it.
Data protection officer requirements under PDPL Saudi Arabia
The regulations require certain controllers to appoint an individual responsible for personal data protection, including public entities, controllers whose main activity involves processing personal data on a large scale, and controllers processing sensitive personal data. The role must have the standing and resources to be effective, which is where nominal appointments tend to fail.
Common questions
Does PDPL Saudi Arabia apply to companies outside Saudi Arabia?
Yes, where they process the personal data of individuals inside the Kingdom. Overseas processing for a Saudi customer base is in scope, and a local representative may be expected.
Can we rely on legitimate interest under PDPL Saudi Arabia?
For non sensitive data, yes, provided you carry out and keep a documented assessment balancing your interest against the individual's rights and there is no less intrusive route. It cannot be used for sensitive personal data.
How is PDPL Saudi Arabia different from the UAE PDPL?
The Saudi framework is more prescriptive. It carries detailed implementing regulations, specific transfer rules and assessment obligations, and it names SDAIA as supervisor. Organisations operating in both markets usually run one programme with country specific controls layered on top.
Where should a Saudi programme start?
With data mapping and a transfer register. Almost every other requirement, from assessments to safeguards to retention, depends on knowing what data you hold and where it goes.