Knowledge Pack — KSA Personal Data Protection Law (PDPL)
Scope
Saudi Arabia's Personal Data Protection Law (PDPL) was enacted by Royal Decree M/19 dated 9/2/1443H (September 2021) and became operative for most entities in September 2023 following a phased rollout supervised by:
- SDAIA — Saudi Data and Artificial Intelligence Authority (policy and enforcement)
- NDMO — National Data Management Office (implementing regulations and technical guidance)
The PDPL applies to:
- Any entity (public or private) that processes personal data of individuals located in Saudi Arabia at the time of processing.
- Extra-territorial: foreign entities processing KSA residents' data to offer goods/services or to monitor behavior in KSA.
- Excluded: data processed for personal/family purposes; national security, crime, or judicial processing by competent authorities; deceased persons' data (except where linked to living persons).
Key Definitions
| Term |
PDPL Definition |
| Personal data |
Any data that identifies or allows identification of a natural person |
| Sensitive data |
Health and medical data; genetic and biometric data; credit/financial data; location data of a continuous or systematic nature; data revealing racial, ethnic, religious, or political views |
| Controller |
Entity that determines purpose and means of processing |
| Processor |
Entity processing on behalf of a controller |
| NDMO |
National Data Management Office — technical regulation |
| SDAIA |
Saudi Data and AI Authority — enforcement and policy |
Lawful Bases for Processing
Unlike GDPR, the KSA PDPL uses a narrower set of lawful bases:
- Controller's legitimate interest — processing that does not override data subject's interests; proportionality required.
- Public interest — government and public sector tasks.
- Legal obligation — required by applicable Saudi law.
- Contract — necessary to perform a contract to which the data subject is a party.
- Vital interests — protect life or health.
- Consent — required specifically for sensitive data and for direct marketing; otherwise not the primary basis.
Sensitive data processing
Requires explicit consent of the data subject plus one of the following additional grounds:
- Legal obligation or judicial procedure
- Legitimate public interest established by regulation
- Protection of vital interests when data subject is unable to consent
Data Subject Rights
| Right |
Mechanism |
| Access |
Request copy of personal data held; no charge for first request annually |
| Rectification |
Correct inaccurate or outdated data |
| Erasure |
Delete when purpose fulfilled, consent withdrawn, or no longer legally required |
| Restriction / objection |
Object to processing for direct marketing; request restriction during dispute |
| Portability |
Receive data in portable format (limited to specific contexts under implementing regs) |
| Withdraw consent |
At any time for consent-based processing |
- Response deadline: 30 days (extendable once with notice).
- NDMO may issue further guidance on specific rights implementation.
Consent Requirements
- Must be written (or electronic equivalent) when required.
- Explicit for sensitive data.
- Specific to the purpose — bundled/blanket consent does not satisfy the requirement.
- Withdrawable — controllers must maintain mechanisms for withdrawal.
- Consent from minors under 18 requires guardian consent.
Cross-Border Data Transfers
Transfer of personal data outside Saudi Arabia is prohibited unless:
- The destination country provides adequate protection — per NDMO adequacy list (currently being developed; GDPR-equivalent jurisdictions used as benchmark).
- Contractual safeguards approved by NDMO (model clauses or binding corporate rules).
- Explicit consent of the data subject for the specific transfer and its risks.
- Transfer necessary for contract performance, judicial proceedings, or legal claims.
- Transfer necessary to protect vital interests when data subject is unable to consent.
- The transfer is in the public interest established by law.
Controllers must document transfer basis and obtain NDMO approval for certain categories.
Data Breach Obligations
- Notify NDMO within 72 hours of becoming aware of a breach likely to harm data subjects.
- Notify affected data subjects without undue delay when the breach may directly affect their rights or interests.
- Maintain internal incident register.
- Implement preventive technical and organizational security measures.
Security Requirements
- Implement technical and organizational security measures proportionate to the nature and risk of processing.
- Physical, administrative, and technical safeguards required.
- Data Processing Agreements (DPAs) with processors mandatory; processors must provide equivalent security guarantees.
- Retention limitation: data must be deleted once the purpose is achieved unless retention is required by law.
Penalties
| Violation |
Administrative Penalty |
| Transfer of personal data outside KSA without authorization |
SAR 3,000,000 (up to SAR 5,000,000 for repeat) |
| Processing sensitive data without required consent/grounds |
SAR 3,000,000 |
| Violating data subject rights |
SAR 1,000,000 |
| Failure to implement security measures / breach notification |
SAR 2,000,000 |
| General PDPL violation |
SAR 1,000,000 (up to SAR 2,000,000 for repeat) |
- Criminal penalties possible for intentional violations causing harm.
- SDAIA may publish violator names publicly (naming and shaming).
- Repeat violations trigger doubled fines.
Sector-Specific Overlays
| Sector |
Additional regulator |
| Financial / banking |
SAMA (Saudi Central Bank) — data and cybersecurity guidance |
| Fintech / crypto |
CMA + SAMA data governance requirements |
| Health data |
Ministry of Health data governance standards |
| Telecom / cloud |
CITC data localization and cybersecurity requirements |
| Government data |
NCA (National Cybersecurity Authority) cloud and data policies |
Health data and financial data are sensitive data under PDPL and require heightened protections.
Data Localization
- KSA does not impose a blanket data-localization requirement under PDPL.
- However, sector-specific regulations (particularly SAMA, MOH, and CITC) impose localization requirements for certain categories of regulated data (financial records, health records, telecom data).
- Cloud computing and SaaS agreements must address localization obligations per sector.
Compliance Checklist
Comparison with GDPR
| Feature |
KSA PDPL |
GDPR |
| Primary regulator |
SDAIA / NDMO |
National DPA (country-specific) |
| Consent model |
Required for sensitive data / marketing; legitimate interest basis available |
Six bases; consent one of six |
| DPO |
Not specifically mandated (NDMO guidance may specify) |
Mandatory in certain cases |
| Max fine |
SAR 5M |
€20M / 4% global turnover |
| Breach notification |
72 hours to NDMO |
72 hours to national DPA |
| Extra-territorial |
Yes |
Yes |
Caveats & Currency
The PDPL's implementing regulations and NDMO guidance have been issued in phases. The adequacy list, approved model clauses, and sector-specific guidance are still developing as of 2025. Consult current NDMO publications before advising. SAMA, CITC, and MOH layered obligations require separate verification per sector.
Related Skills
- [[kb-data-privacy-gdpr]]
- [[kb-data-privacy-egypt]]
- [[kb-data-privacy-uae-pdpl]]
- [[kb-fintech-licensing-cma-ksa]]
- [[kb-healthcare-regulation-mena]]
- [[draft-data-processing-agreement]]
- [[draft-privacy-policy]]
1---2name: kb-data-privacy-ksa-pdpl3description: Use when a matter involves personal data processing, privacy obligations, or data-breach response in Saudi Arabia. Covers the KSA Personal Data Protection Law (Royal Decree M/19 2021, effective 2022–2023) and NDMO implementing regulations, lawful bases, sensitive data categories, cross-border transfer restrictions, data subject rights, and PDPL penalties up to SAR 5 million. Triggers on questions about PDPL KSA, Saudi data privacy, SDAIA, NDMO compliance, or data controller obligations in Saudi Arabia.4license: MIT5---67# Knowledge Pack — KSA Personal Data Protection Law (PDPL)89## Scope1011Saudi Arabia's **Personal Data Protection Law (PDPL)** was enacted by Royal Decree M/19 dated 9/2/1443H (September 2021) and became operative for most entities in **September 2023** following a phased rollout supervised by:1213- **SDAIA** — Saudi Data and Artificial Intelligence Authority (policy and enforcement)14- **NDMO** — National Data Management Office (implementing regulations and technical guidance)1516The PDPL applies to:17- Any entity (public or private) that processes personal data of **individuals located in Saudi Arabia** at the time of processing.18- Extra-territorial: foreign entities processing KSA residents' data to offer goods/services or to monitor behavior in KSA.19- Excluded: data processed for personal/family purposes; national security, crime, or judicial processing by competent authorities; deceased persons' data (except where linked to living persons).2021## Key Definitions2223| Term | PDPL Definition |24|---|---|25| Personal data | Any data that identifies or allows identification of a natural person |26| Sensitive data | Health and medical data; genetic and biometric data; credit/financial data; location data of a continuous or systematic nature; data revealing racial, ethnic, religious, or political views |27| Controller | Entity that determines purpose and means of processing |28| Processor | Entity processing on behalf of a controller |29| NDMO | National Data Management Office — technical regulation |30| SDAIA | Saudi Data and AI Authority — enforcement and policy |3132## Lawful Bases for Processing3334Unlike GDPR, the KSA PDPL uses a narrower set of lawful bases:35361. **Controller's legitimate interest** — processing that does not override data subject's interests; proportionality required.372. **Public interest** — government and public sector tasks.383. **Legal obligation** — required by applicable Saudi law.394. **Contract** — necessary to perform a contract to which the data subject is a party.405. **Vital interests** — protect life or health.416. **Consent** — required specifically for sensitive data and for direct marketing; otherwise not the primary basis.4243### Sensitive data processing44Requires **explicit consent** of the data subject **plus** one of the following additional grounds:45- Legal obligation or judicial procedure46- Legitimate public interest established by regulation47- Protection of vital interests when data subject is unable to consent4849## Data Subject Rights5051| Right | Mechanism |52|---|---|53| Access | Request copy of personal data held; no charge for first request annually |54| Rectification | Correct inaccurate or outdated data |55| Erasure | Delete when purpose fulfilled, consent withdrawn, or no longer legally required |56| Restriction / objection | Object to processing for direct marketing; request restriction during dispute |57| Portability | Receive data in portable format (limited to specific contexts under implementing regs) |58| Withdraw consent | At any time for consent-based processing |5960- Response deadline: **30 days** (extendable once with notice).61- NDMO may issue further guidance on specific rights implementation.6263## Consent Requirements6465- Must be **written** (or electronic equivalent) when required.66- **Explicit** for sensitive data.67- **Specific** to the purpose — bundled/blanket consent does not satisfy the requirement.68- **Withdrawable** — controllers must maintain mechanisms for withdrawal.69- Consent from **minors** under 18 requires guardian consent.7071## Cross-Border Data Transfers7273Transfer of personal data outside Saudi Arabia is **prohibited** unless:74751. The destination country provides **adequate protection** — per NDMO adequacy list (currently being developed; GDPR-equivalent jurisdictions used as benchmark).762. **Contractual safeguards** approved by NDMO (model clauses or binding corporate rules).773. **Explicit consent** of the data subject for the specific transfer and its risks.784. Transfer necessary for contract performance, judicial proceedings, or legal claims.795. Transfer necessary to protect vital interests when data subject is unable to consent.806. The transfer is in the **public interest** established by law.8182Controllers must document transfer basis and obtain NDMO approval for certain categories.8384## Data Breach Obligations8586- Notify **NDMO within 72 hours** of becoming aware of a breach likely to harm data subjects.87- Notify **affected data subjects without undue delay** when the breach may directly affect their rights or interests.88- Maintain internal incident register.89- Implement preventive technical and organizational security measures.9091## Security Requirements9293- Implement **technical and organizational security measures** proportionate to the nature and risk of processing.94- Physical, administrative, and technical safeguards required.95- **Data Processing Agreements (DPAs)** with processors mandatory; processors must provide equivalent security guarantees.96- Retention limitation: data must be deleted once the purpose is achieved unless retention is required by law.9798## Penalties99100| Violation | Administrative Penalty |101|---|---|102| Transfer of personal data outside KSA without authorization | SAR 3,000,000 (up to SAR 5,000,000 for repeat) |103| Processing sensitive data without required consent/grounds | SAR 3,000,000 |104| Violating data subject rights | SAR 1,000,000 |105| Failure to implement security measures / breach notification | SAR 2,000,000 |106| General PDPL violation | SAR 1,000,000 (up to SAR 2,000,000 for repeat) |107108- Criminal penalties possible for intentional violations causing harm.109- SDAIA may publish violator names publicly (naming and shaming).110- Repeat violations trigger doubled fines.111112## Sector-Specific Overlays113114| Sector | Additional regulator |115|---|---|116| Financial / banking | SAMA (Saudi Central Bank) — data and cybersecurity guidance |117| Fintech / crypto | CMA + SAMA data governance requirements |118| Health data | Ministry of Health data governance standards |119| Telecom / cloud | CITC data localization and cybersecurity requirements |120| Government data | NCA (National Cybersecurity Authority) cloud and data policies |121122Health data and financial data are **sensitive data** under PDPL and require heightened protections.123124## Data Localization125126- KSA does not impose a blanket data-localization requirement under PDPL.127- However, **sector-specific regulations** (particularly SAMA, MOH, and CITC) impose localization requirements for certain categories of regulated data (financial records, health records, telecom data).128- Cloud computing and SaaS agreements must address localization obligations per sector.129130## Compliance Checklist131132- [ ] Data mapping: inventory all personal data flows in KSA operations133- [ ] Identify and document lawful basis for each processing activity134- [ ] Obtain explicit consent for sensitive-data processing135- [ ] Review and update privacy notices (Arabic mandatory; bilingual recommended)136- [ ] Establish consent-withdrawal mechanisms137- [ ] Put Data Processing Agreements in place with all processors138- [ ] Assess cross-border transfer mechanisms for data leaving KSA139- [ ] Implement 72-hour breach notification procedure140- [ ] Establish data subject rights request-handling process141- [ ] Check sector-specific data localization obligations142143## Comparison with GDPR144145| Feature | KSA PDPL | GDPR |146|---|---|---|147| Primary regulator | SDAIA / NDMO | National DPA (country-specific) |148| Consent model | Required for sensitive data / marketing; legitimate interest basis available | Six bases; consent one of six |149| DPO | Not specifically mandated (NDMO guidance may specify) | Mandatory in certain cases |150| Max fine | SAR 5M | €20M / 4% global turnover |151| Breach notification | 72 hours to NDMO | 72 hours to national DPA |152| Extra-territorial | Yes | Yes |153154## Caveats & Currency155156The PDPL's implementing regulations and NDMO guidance have been issued in phases. The adequacy list, approved model clauses, and sector-specific guidance are still developing as of 2025. Consult current NDMO publications before advising. SAMA, CITC, and MOH layered obligations require separate verification per sector.157158## Related Skills159160- [[kb-data-privacy-gdpr]]161- [[kb-data-privacy-egypt]]162- [[kb-data-privacy-uae-pdpl]]163- [[kb-fintech-licensing-cma-ksa]]164- [[kb-healthcare-regulation-mena]]165- [[draft-data-processing-agreement]]166- [[draft-privacy-policy]]
sboghossian