Saudi Arabia’s PDPL, for companies serving the Kingdom.
The PDPL applies to processing of data about people living in Saudi Arabia, including by companies abroad. Add Saudi Arabia in Privacyboard: your policy gains the notice, your requests the 30-day deadline.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Processing in the Kingdom, or of people living there
- Maximum fine
- SAR 5 million, doubled for repeat breaches
- Deadlines
- 30 days per request, 72 hours per breach
- In Privacyboard
- On every plan, Free included
What the PDPL asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
Purposes, legal bases, recipients, transfers and rights.
In Privacyboard
A Saudi section added to your policy from your records.
Every plan
Show all 5 duties as a list
Art. 12A notice for the KingdomEvery plan
What the law asks: Purposes, legal bases, recipients, transfers and rights.
In Privacyboard: A Saudi section added to your policy from your records.
Reg. Art. 3Answer within 30 daysEvery plan
What the law asks: 30 days, plus 30 more for complex or repeated requests.
In Privacyboard: Saudi Arabia in the request form, with its deadline. Request form on Pro.
Reg. Art. 24Report breaches in 72 hoursEvery plan
What the law asks: Notify SDAIA within 72 hours when harm is possible.
In Privacyboard: The breach register names SDAIA and the deadline.
Art. 29Protect transfers abroadEvery plan
What the law asks: Adequate countries, or safeguards such as SDAIA’s clauses.
In Privacyboard: Providers outside the Kingdom listed in your notice.
RegisterCheck if you must registerEvery plan
What the law asks: Companies processing sensitive data, or whose core activity is data, register with SDAIA.
In Privacyboard: Flagged in What applies to you, with the official link.
The numbers to know
per breach of the law, doubled for repeats
to notify SDAIA of a breach
to answer a request, plus 30 if needed
Disclosing sensitive data to harm someone can lead to 2 years in prison. Amendments to the Implementing Regulation are in draft.
What Privacyboard covers, and what it does not
Covered
- A Saudi notice in your policy
- Saudi Arabia in the request form, 30 days
- SDAIA in the breach register
- Transfers outside the Kingdom listed
- Registration flagged when it may apply
Not covered
- Registering with SDAIA for you
- Transfer risk assessments under SDAIA rules
- An Arabic version of your documents
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Add Saudi Arabia
In Company profile, Activity.
- 2
Check registration
Shown in What applies to you.
- 3
Validate your policy
It now has a Saudi notice.
- 4
Publish your center
The Kingdom appears in the form.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Does the PDPL apply to companies outside Saudi Arabia?
Yes, to processing of data about people living in the Kingdom (Art. 2).
Do we need to register with SDAIA?
If you process sensitive data or your core activity is processing personal data. Companies abroad register through a representative.
Does the cookie banner change for Saudi visitors?
It follows your rules for the rest of the world. You can choose to ask for consent everywhere.
Are the 2026 amendments in force?
No. They were in public consultation until November 2026.
Official sources
- SDAIA, Personal Data Protection Law (Arabic)
- SDAIA, Implementing Regulation (Arabic)
- SDAIA, Regulation on transfers outside the Kingdom
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
