Saudi PDPL vs GDPR: Key Differences for International Companies A side-by-side comparison from Sumrite.

This guide is for European and other international companies with a GDPR programme that now process personal data about people in Saudi Arabia. For the full Saudi framework, start with our Saudi PDPL compliance guide.

How do the Saudi PDPL and the GDPR compare at a glance?

The Saudi PDPL and the GDPR share the same building blocks, but the PDPL differs on legal bases, the right to object, record-keeping, transfers, registration and penalties. The table below summarises the position as of November 2026, using the text of the PDPL published by SDAIA and the GDPR on EUR-Lex.

Topic	EU GDPR	Saudi PDPL
In force	Applies since 25 May 2018	In force 14 September 2023; fully enforceable 14 September 2024
Regulator	National supervisory authorities	Saudi Data & AI Authority (SDAIA)
Territorial reach	EU establishment, or offering goods/services to or monitoring people in the EU (Article 3)	Processing in the Kingdom, and processing abroad of data about Saudi residents (Article 2)
Default legal basis	Six equal bases (Article 6)	Consent is the main basis, with listed exceptions (Articles 5 and 6)
Right to object	Yes (Article 21)	No general right; consent withdrawal and marketing opt-out instead
Rights response time	One month, extendable by two months	30 days, extendable by 30 days
Records of processing	Article 30, with a limited exemption under 250 staff	Article 31, no size exemption, kept for five years after processing ends
Breach notice to regulator	72 hours unless unlikely to pose risk (Article 33)	72 hours where the breach may cause harm (Implementing Regulation Article 24)
Local representative	Required for many non-EU controllers (Article 27)	Not required
Registration	No general registration	SDAIA National Register of Controllers for defined categories
Maximum fine	EUR 20 million or 4% of worldwide turnover (Article 83(5))	SAR 5 million per violation, doubled for repeats (Article 36)
Criminal penalties	Left to member states	Up to two years and SAR 3 million for disclosing sensitive data with intent to harm (Article 35)

Much of the comparison below draws on the GDPR v. Saudi PDPL comparison report published by OneTrust DataGuidance and Clyde & Co in February 2025, checked against the official texts.

Who does each law apply to?

The Saudi PDPL applies to any processing of personal data in Saudi Arabia and to processing outside the Kingdom of personal data about individuals residing in Saudi Arabia, without the GDPR’s “offering goods or services” or “monitoring” tests. The GDPR, by contrast, reaches non-EU companies only when they target or monitor people in the EU.

Under GDPR Article 3(2), a company outside the EU is caught because of what it does. Under PDPL Article 2, a company outside Saudi Arabia is caught because of whose data it handles: a European payroll provider processing data about Saudi-resident staff of a group company is in scope even if it markets nothing in the Kingdom. SDAIA’s own guide for controllers and processors works through a scenario of this kind.

The PDPL does not require a foreign controller to appoint a representative in the Kingdom, unlike GDPR Article 27. That does not reduce exposure: SDAIA can still open a case, and its National Data Governance Platform has a registration route for entities outside the Kingdom.

How do legal bases differ between the PDPL and the GDPR?

The GDPR gives six equal legal bases, while the Saudi PDPL starts from consent and allows processing without consent only in listed cases, including legitimate interest, which can never be used for sensitive data. European teams that rely heavily on legitimate interest need to revisit those decisions for Saudi data.

Consent

The PDPL Implementing Regulation requires consent to be freely given, specific to each purpose and documented. Explicit consent is needed for sensitive data, credit data and decisions based solely on automated processing, as Clyde & Co summarised when the Regulation was issued in September 2023. Consent is also required for advertising and direct marketing, with a simple way to opt out at any time.

Legitimate interest

Legitimate interest exists under the PDPL, with a documented balancing assessment, but Article 6 bars it for sensitive data. Reuse GDPR assessments as templates, not as conclusions.

Sensitive data

The categories overlap but are not identical:

In both laws

Racial or ethnic origin, religious and political belief (GDPR adds philosophical belief; the PDPL says intellectual belief), genetic data, biometric data used for identification, health data

GDPR only (Article 9)

Trade union membership, sex life and sexual orientation

PDPL only

Criminal convictions and offences (handled separately under GDPR Article 10), and data revealing that one or both parents are unknown

How do data subject rights differ?

Both laws give rights to information, access, correction, deletion and a copy of the data, but the Saudi PDPL has no general right to object and sets a 30-day response deadline extendable by 30 days, against the GDPR’s one month extendable by two months. Article 4 of the PDPL lists the rights and Article 5 adds withdrawal of consent.

Information, access, correction, destruction

Both laws. The PDPL copy must be in a clear, readable format.

Portability to another controller

GDPR Article 20 only.

Objection

GDPR Article 21 only. Under the PDPL, use consent withdrawal and the marketing opt-out.

Response time

GDPR: one month plus two. PDPL: 30 days plus 30, with reasons given.

A service desk working to “one month plus two” will miss PDPL deadlines on complex requests, so apply the Saudi clock to Saudi requests.

How do records, impact assessments and breach rules differ?

The Saudi PDPL requires every controller to keep written records of processing for as long as processing continues plus five years, with no small-company exemption, lists fixed triggers for impact assessments, and requires breach notice to SDAIA within 72 hours where a breach may cause harm. The GDPR exempts some organisations with fewer than 250 employees from records duties, leaves impact assessments to a risk test and exempts breaches unlikely to pose a risk.

Records of processing

Under PDPL Article 31, the record covers the controller’s details, purposes, categories of data and data subjects, recipients, retention periods, transfers outside the Kingdom and, where possible, security measures. Your GDPR Article 30 record is a good base; add a transfers column that names the PDPL mechanism and a retention column that keeps entries five years after processing ends. Our guide to personal data discovery for the PDPL explains how to build that record from real systems rather than interviews alone.

Impact assessments, DPO and registration

The PDPL requires an impact assessment for listed processing, including sensitive data, linking datasets from different sources, continuous monitoring, new technologies and automated decisions. DPO triggers resemble GDPR Article 37, but DPO details are filed with SDAIA. The PDPL also has something the GDPR does not: a National Register of Controllers for public entities, controllers whose main activity is processing personal data and controllers that process sensitive data.

Breach notification

Notice goes to SDAIA through the National Data Governance Platform under Implementing Regulation Article 24, not to your EU lead authority, so someone must hold platform credentials before an incident. GDPR Article 34 exempts some notices to individuals, for example where data was encrypted; the PDPL has no equivalent explicit exemption, according to DataGuidance. SDAIA’s October 2026 draft amendments would also drop the harm test for notifying SDAIA, but as of 11 November 2026 that is a proposal, not law; see our analysis of the draft PDPL Implementing Regulation amendments.

How do international transfer rules differ?

Both laws allow transfers abroad on the basis of adequacy or appropriate safeguards, but Saudi transfers run under PDPL Article 29 and SDAIA’s own Regulation on Personal Data Transfer outside the Kingdom, with Saudi Standard Contractual Clauses, a data-minimisation condition and a transfer risk assessment in defined cases. EU SCCs do not cover a transfer out of Saudi Arabia.

The Saudi SCCs are a fixed template governed by Saudi law, so a European importer submits to Saudi jurisdiction. Our guide to PDPL cross-border data transfers walks through each route.

How do PDPL penalties compare with GDPR fines?

The Saudi PDPL caps administrative fines at SAR 5 million per violation, doubled for repeat violations, while the GDPR allows fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The PDPL also carries criminal penalties of up to two years’ imprisonment and a SAR 3 million fine for disclosing or publishing sensitive data with intent to harm or for personal benefit.

Fines are “per violation”, so one campaign or one weak system can produce several. And SDAIA is enforcing: on 16 January 2026 the Saudi Press Agency reported that SDAIA’s committees had issued 48 decisions confirming violations in the previous year, including missing safeguards and marketing without consent. Our guide to Saudi PDPL penalties and SDAIA enforcement covers the procedure and its five-day response window.

What should a GDPR-compliant company change for the Saudi PDPL?

A GDPR-compliant company should reuse its governance, records and security programme, then add Saudi-specific legal bases, the shorter rights clock, five-year record retention, SDAIA registration, SDAIA transfer mechanisms and a Saudi breach route. The checklist below is the order we follow with European clients.

The security step is where most of the GDPR work carries straight over. Article 19 of the PDPL, like GDPR Article 32, requires appropriate technical and organisational measures without listing controls. A current web application penetration test and cloud security assessment of Saudi-facing systems serve both laws. Our guide to GDPR penetration testing requirements explains how to scope one test for both, and our GDPR compliance page covers the European side. For a full list to tick off, use our PDPL compliance checklist.

How Sumrite helps

Sumrite maps your GDPR programme against the Saudi PDPL, closes the gaps in legal bases, records, registration and transfers, and runs the security testing that proves your safeguards to both European regulators and SDAIA. Sumrite delivers this end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our Saudi PDPL compliance page sets out the engagement, and our Saudi Arabia page explains how we deliver a Sumrite VAPT report for Saudi reviews in 48 hours.