On this page
Delivered with a verified NCA-registered partner
Summit runs PDPL readiness and VAPT for Saudi organisations end to end, with our verified NCA-registered partner firm, and has served 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
Forty-eight decisions is not a huge number. The categories are what matter. None of them are exotic, and every one is something an ordinary Saudi business could be doing today.
What was actually penalised
The four categories reported in SDAIA’s announcement map neatly onto everyday operations:
| Violation category | Where it usually hides |
|---|---|
| Processing without a legal basis | CRM imports, bought lists, “we’ve always collected it” fields on forms |
| Disclosure without legal justification | Sharing customer data with partners, agencies or group companies without a basis or agreement |
| Failure to implement organisational, administrative and technical safeguards | Unpatched portals, weak access control, no testing, no logging |
| Marketing without consent | SMS and WhatsApp campaigns to customers who never opted in |
The individual decisions, the controllers’ names and the fine amounts have not been published. So be wary of anyone quoting “average PDPL fines”. The categories are the reliable signal.
The penalty ceiling
- General violations: a warning or a fine of up to SAR 5 million, which can be doubled for repeat violations.
- Intentional disclosure or publication of sensitive data, with intent to harm the data subject or for personal benefit: up to two years’ imprisonment and/or a fine of up to SAR 3 million.
- The committees can also require final penalties to be published. For a consumer brand, that can cost more than the fine.
The procedure is faster than most companies expect
According to Clyde & Co’s March 2026 analysis of the committees’ Rules of Procedure, cases run through an electronic platform with short deadlines:
- 5 days to respond once notified of an alleged violation;
- 15 days for the committee’s decision to be notified after it is issued;
- 60 days to appeal to the competent court.
Access to the statement of claim is not automatic. An authorised representative has to upload proof of authority first. If nobody in your company knows who holds the power of attorney, you can lose days of a five-day window to paperwork.
The security angle most legal reviews miss
“Failure to implement safeguards” is the category where cybersecurity and privacy meet. The PDPL expects controllers to protect personal data with appropriate organisational, administrative and technical measures. When a committee asks how you protected a database, the persuasive answer is evidence:
- a recent penetration test of the systems holding personal data, with findings closed;
- a vulnerability management record;
- access reviews and logs;
- a tested breach response plan.
That is where VAPT stops being an IT line item and becomes part of your legal defence.
Breach notification: 72 hours
Under the PDPL Implementing Regulation (Article 24), controllers must notify SDAIA within 72 hours of becoming aware of a personal data breach. Affected individuals must be told without undue delay where the breach is likely to cause them harm. Notifications go through SDAIA’s National Data Governance Platform.
Seventy-two hours disappears fast over a Thursday-to-Saturday weekend. Decide now who assesses the breach, who drafts the notice, and who presses submit.
A 30/60/90-day readiness plan
First 30 days: get findable
- Confirm who holds power of attorney and platform access for SDAIA proceedings.
- Inventory processing activities: what data, which legal basis, which systems.
- Freeze marketing to any list where you cannot show consent.
Days 31 to 60: close the obvious gaps
- Fix legal-basis gaps and update privacy notices.
- Put data-sharing agreements in place with processors and partners.
- Run a penetration test on systems that hold personal data, prioritising customer portals and apps.
Days 61 to 90: prove it
- Rehearse the 72-hour breach notification with a tabletop exercise.
- Set up a data subject request workflow with deadlines.
- Assemble an evidence binder: records of processing, test reports, remediation, training.
How Summit helps
Summit’s Saudi PDPL guide sets out how we approach gap assessment, records of processing, consent and notice remediation, and breach-response readiness. Our VAPT, delivered with our verified NCA-registered partner, produces the technical-safeguard evidence a committee will ask for. We have worked with 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities, end to end.
Get ahead of the next 48
Book a PDPL readiness review with Summit and leave with a prioritised remediation plan. Start here.
Related reading: Draft PDPL amendments, October 2026 · NCA ECC penetration testing
Frequently asked questions
How many PDPL enforcement decisions has SDAIA issued?
On 16 January 2026, the Saudi Press Agency reported that SDAIA's violation review committees had issued 48 decisions confirming violations and enforcing the prescribed penalties on data controllers, covering 2025.
What is the maximum PDPL fine in Saudi Arabia?
Up to SAR 5 million per violation, which can be doubled for repeat violations. Intentional disclosure of sensitive data can also bring up to two years' imprisonment and/or a fine of up to SAR 3 million.
How quickly must a company respond to an SDAIA violation notice?
Within five days of notification, according to the committees' Rules of Procedure as summarised by Clyde & Co.
What is the PDPL breach notification deadline?
72 hours from becoming aware of the breach, notified to SDAIA. Affected individuals must be notified without undue delay where harm is likely.
Does the PDPL apply to companies outside Saudi Arabia?
Yes. It applies to processing of personal data relating to individuals in the Kingdom, including by entities located outside it.
