Cookie consent in المملكة العربية السعودية
Consent and privacy law in المملكة العربية السعودية
Personal Data Protection Law enforceable from September 2023, full effect from 2024
ar
Who must comply
Any entity that processes personal data of individuals residing in Saudi Arabia, including controllers based abroad that process such data.
Penalties
Fines up to 5 million riyals, and up to 3 million riyals plus prison for sensitive data disclosure
Key obligations
- Obtain consent before processing unless an exception applies
- Provide a privacy notice of purpose and rights
- Honor access, correction and deletion rights
- Register with the authority and appoint a data protection officer where required
- Meet conditions for cross-border transfers and report breaches
Local guidance
- Apply the PDPL overseen by SDAIA
- Meet the conditions before transferring data outside the Kingdom
- Document consent and provide notices in Arabic
- Take special care with sensitive data given criminal exposure
How ConsentX helps
- Consent capture before processing
- Geo-aware banner for visitors in Saudi Arabia
- Rights request workflow with evidence
- Consent receipts for audit
- Region rule engine tuned for Saudi Arabia
We value your privacy
We ask for your consent before any non-essential cookie, with the rules that apply in your region.
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with Saudi Arabia using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Saudi Arabia.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Saudi Arabia requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Saudi Arabia audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Does Saudi Arabia restrict data transfers abroad?+
Yes. The PDPL places significant controls on transferring personal data outside the Kingdom and emphasises data localisation, with transfers permitted only when specified conditions are met.
Are there criminal penalties under Saudi Arabia's PDPL?+
Yes. Unlawful disclosure of sensitive data can lead to criminal penalties including fines up to 3 million riyals and imprisonment, on top of administrative fines.