Saudi PDPL Compliance Guide 2026: Enforcement Is Now Live What the law requires, explained by Sumrite.

This is the hub page for Sumrite’s PDPL guides. It explains what the law asks of you as of November 2026, what SDAIA has actually enforced, and where each deeper guide fits. Each section links to the official text on SDAIA’s site so you can check the wording yourself.

What is the Saudi PDPL and when did it take effect?

The Saudi PDPL is the Kingdom’s general data protection law, issued by Royal Decree No. M/19 (9 Safar 1443H) and amended by Royal Decree No. M/148 (5 Ramadan 1444H). The PDPL came into force on 14 September 2023 and, after a one-year grace period, became fully enforceable on 14 September 2024.

The Saudi Press Agency confirms both decree numbers, and the Arabic text of the law is published by the Bureau of Experts at the Council of Ministers. SDAIA publishes the English Personal Data Protection Law and its Implementing Regulation, plus a separate regulation on transfers outside the Kingdom. SDAIA’s own guide for controllers and processors gives the 14 September 2023 effective date and the one-year compliance window.

Law

Personal Data Protection Law, Royal Decree No. M/19, amended by Royal Decree No. M/148

In force

14 September 2023

Fully enforceable

14 September 2024, after a one-year grace period

Regulator

Saudi Data & AI Authority (SDAIA)

Secondary rules

Implementing Regulation; Regulation on Personal Data Transfer outside the Kingdom

Enforcement to date

48 violation decisions reported on 16 January 2026

Fine ceiling

Up to SAR 5 million per violation, doubled for repeats

Breach notice

SDAIA within 72 hours of becoming aware, under Implementing Regulation Article 24

Who does the Saudi PDPL apply to?

The Saudi PDPL applies to any processing of personal data in Saudi Arabia, and to processing by parties outside the Kingdom of personal data about individuals residing in Saudi Arabia. Purely personal or family use is excluded, provided the data is not published or disclosed to others.

Article 2 sets that scope, and SDAIA’s guide works through a scenario in which a company with no Saudi presence is caught because it processes Saudi residents’ data. In practice, the PDPL reaches:

• Saudi companies in every sector, public and private;
• foreign SaaS providers, e-commerce sites and apps with Saudi users;
• group companies and shared-service centres abroad that handle Saudi staff or customer data;
• processors (vendors) acting for a controller, through the controller’s contractual duty to make sure its processors comply.

Sector regulators still apply their own rules on top. The Saudi Central Bank (SAMA), the National Cybersecurity Authority (NCA) and the Communications, Space and Technology Commission (CST) all have data and security requirements that sit alongside the PDPL. If you sell into the Kingdom from abroad, our guide to selling SaaS into Saudi Arabia shows how buyers combine these into one questionnaire.

What does SDAIA’s PDPL enforcement look like in 2026?

SDAIA enforces the PDPL through specialised committees for reviewing violations, and on 16 January 2026 the Saudi Press Agency reported that those committees had issued 48 decisions confirming violations and enforcing penalties on data controllers during the previous year. The penalties were imposed under Article 36 of the PDPL.

The reported violations were ordinary, not exotic:

Violation reported by SDAIA	Where it usually hides
Collecting and processing personal data in breach of the law	CRM imports, bought lists, form fields nobody can justify
Disclosing personal data without legal justification	Sharing with agencies, partners or group companies with no basis or agreement
Failing to implement organisational, administrative and technical safeguards	Unpatched portals, weak access control, no security testing, no logging
Sending advertising and marketing messages without consent	SMS, WhatsApp and email campaigns to people who never opted in

SDAIA has not published the controllers’ names or the fine amounts, so treat any “average PDPL fine” figure with suspicion. The committees include technical and legal experts and can summon parties and request reports, according to an earlier Saudi Press Agency statement from April 2025. For the penalty ceiling, the procedure and its short deadlines, read our detailed guide to Saudi PDPL penalties and SDAIA enforcement.

What are the core PDPL obligations for controllers?

The core PDPL obligations are a lawful basis for every processing purpose, clear notice, honouring data subject rights within set deadlines, records of processing, impact assessments for high-risk processing, appropriate security, breach notification and controls on transfers abroad. Some controllers must also appoint a data protection officer (DPO) and register with SDAIA.

Lawful basis and consent

Articles 5 and 6 of the PDPL set out the lawful bases. Consent remains central, legitimate interest is available with a documented balancing test but never for sensitive data, and the Implementing Regulation requires explicit consent for sensitive data. Marketing messages need consent and an easy way to opt out, as summarised by Clyde & Co when the Regulation was issued in September 2023.

Data subject rights

Article 4 gives individuals the right to be informed, to access their data, to receive it in a readable format, to have it corrected and to have it destroyed, and Article 5 lets them withdraw consent. Controllers have 30 days to respond, extendable by a further 30 days in defined cases.

Records, assessments, DPO and registration

• Records of processing must be kept for as long as processing continues plus five years.
• Impact assessments are required for higher-risk processing such as sensitive data, large-scale monitoring, new technologies and fully automated decisions.
• A DPO is required for public entities processing at large scale, controllers whose core activities involve regular monitoring, and controllers whose core activities involve sensitive data. SDAIA issued separate DPO appointment rules, announced by the Saudi Press Agency in August 2024.
• Registration on SDAIA’s National Register of Controllers applies to defined categories. See our guide to the SDAIA National Register of Controllers.

For a working list you can tick off, use our PDPL compliance checklist.

How does the Saudi PDPL treat cross-border data transfers?

The Saudi PDPL allows personal data to be transferred outside the Kingdom under Article 29 only for defined purposes and conditions, such as not prejudicing national security or vital interests and sending only the minimum data needed. Transfers rely on adequacy, appropriate safeguards or limited exemptions set out in SDAIA’s Transfer Regulation.

The main safeguard routes are binding common rules, approved codes of conduct, certification and SDAIA’s Standard Contractual Clauses (version 1.0, September 2024), which come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. A transfer risk assessment is required in several cases, including when you rely on safeguards or exemptions.

The rules are detailed enough to deserve their own guide: PDPL cross-border data transfers. European companies comparing these routes with GDPR Chapter V should read Saudi PDPL vs GDPR.

What security measures does the Saudi PDPL require?

Article 19 of the Saudi PDPL requires controllers to take the organisational, administrative and technical measures needed to protect personal data, including during transfer. The law does not list specific controls, which is why evidence that your controls work matters so much when SDAIA asks.

“Failure to implement appropriate safeguards” was one of the four violation types in SDAIA’s January 2026 announcement. When a committee asks how you protected a database, the persuasive answer is a file of evidence:

Under Article 24 of the Implementing Regulation, controllers notify SDAIA within 72 hours of becoming aware of a breach that may harm individuals, and notify affected individuals without undue delay, through SDAIA’s National Data Governance Platform. If you also fall under the NCA’s controls, our NCA ECC compliance guide and the NCA ECC compliance page explain how one testing programme can serve both.

What is changing in the PDPL Implementing Regulation?

On 6 October 2026 SDAIA published draft amendments to the PDPL Implementing Regulation for public consultation, with comments accepted until 5 November 2026, as reported by the Saudi Press Agency. As of 11 November 2026 the draft is not law: no approved text has been published in the Official Gazette, and the current Regulation still applies.

According to law-firm analysis of the draft, it would add an express duty to store personal data inside the Kingdom (Article 23), drop the harm test for notifying SDAIA of breaches (Article 24), widen DPO and registration triggers, and set 20 business days for responses to SDAIA requests. As drafted, the changes would take effect 60 days after publication. Our analysis of the October 2026 draft Implementing Regulation amendments covers each change.

SDAIA is also building an audit market. In July 2026 it consulted on draft guidelines for licensing entities that audit and inspect personal data processing. Expect independent PDPL audits to become a normal procurement question once those rules are final.

How do you build a PDPL compliance programme?

A defensible PDPL programme starts with knowing what personal data you hold and why, then closes legal-basis, rights, security and transfer gaps, and finishes with evidence you can hand to SDAIA within days. The steps below are the order we follow with Saudi clients.

How Sumrite helps

Sumrite runs PDPL gap assessments, records-of-processing and consent remediation, breach-readiness exercises and the security testing that proves your safeguards, end to end with our verified NCA-registered partner firm. We have served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our Saudi PDPL compliance page sets out the engagement, and the Saudi landing page explains how we turn around a Sumrite VAPT report for Saudi reviews in 48 hours. You can also start with a free one-minute external scan at scan.sumrite.com.