PDPL Saudi Arabia: a practical guide for start-ups entering the Kingdom

Series

Start-up compliance series · 3 of 7

In force

14 September 2023; general alignment period ended 14 September 2024

Regulator

SDAIA, with sector regulators where applicable

Scope

Processing in Saudi Arabia and specified processing of residents' data by organisations outside the Kingdom

Reach and enforcement under PDPL Saudi Arabia

The Saudi data protection law has cross border reach. A start-up outside the Kingdom may fall within scope when it processes personal data relating to individuals residing there, even without a Saudi entity.

The law and its implementing framework provide for regulatory sanctions, compensation claims and specific criminal exposure in defined circumstances. Applicability and potential consequences should be assessed against current official texts.

Core Saudi data protection obligations

• Lawful processing. Consent is an important legal basis, alongside defined statutory alternatives and conditions.
• Registration. Controllers should determine whether and how registration on the National Data Governance Platform applies to them.
• Personal data breaches. The implementing framework includes a 72 hour regulator notification requirement in applicable cases and notice to affected individuals where required.
• Data protection officer. DPO designation depends on criteria including the nature and scale of processing, systematic monitoring and sensitive data.
• Operational policies. SDAIA has issued supporting materials addressing areas such as privacy notices, destruction, anonymisation, pseudonymisation and disclosure.

Sector overlays

Banking, telecommunications, postal services, information technology, health and government activities may carry additional controls. Fintech and health start-ups should assess relevant sector requirements before selecting infrastructure or finalising data flows.

Five actions before entering the Kingdom

• Assess registration. Determine the organisation's obligations on the National Data Governance Platform.
• Prepare for the 72 hour clock. Create a breach assessment and escalation process that can support timely decisions.
• Publish an appropriate privacy notice. Align user facing information with the PDPL, implementing regulations and current SDAIA guidance.
• Document the DPO decision. Assess the designation criteria and record the basis for the conclusion.
• Control international transfers. Put the required transfer mechanism and supporting assessment in place before Saudi personal data moves abroad.

Sources and scope

Source briefing: DLA Piper, Saudi Arabia; Mayer Brown, October 2024 update on SDAIA regulations and guidelines.

This article provides general information for start-ups and does not constitute legal advice. Requirements should be checked against current official sources and assessed for the organisation's circumstances before reliance.