Does Saudi Arabia restrict data transfers abroad?

Yes. The PDPL places significant controls on transferring personal data outside the Kingdom and emphasises data localisation, with transfers permitted only when specified conditions are met.

Are there criminal penalties under Saudi Arabia's PDPL?

Yes. Unlawful disclosure of sensitive data can lead to criminal penalties including fines up to 3 million riyals and imprisonment, on top of administrative fines.

Middle East & North Africa

Cookie consent in المملكة العربية السعودية

Consent and privacy law in المملكة العربية السعودية

Saudi Arabia's Personal Data Protection Law is overseen by SDAIA and became enforceable in September 2023, with a compliance grace period running into 2024. The law is comprehensive and in some areas strict, requiring a lawful basis, transparency, and data subject rights. A distinctive feature is a strong emphasis on data localisation and controls on transferring personal data outside the Kingdom, which require meeting specified conditions. Disclosing sensitive data unlawfully can lead to criminal penalties including imprisonment. Consent is a key basis and must be documented. Notices in Arabic are expected. Cookies that identify users are personal data subject to the law.

Authority

Saudi Data and Artificial Intelligence Authority (SDAIA)

Status

Personal Data Protection Law enforceable from September 2023, full effect from 2024

Primary law

PDPL KSA

Languages

العربية

Who must comply

Any entity that processes personal data of individuals residing in Saudi Arabia, including controllers based abroad that process such data.

Penalties

Fines up to 5 million riyals, and up to 3 million riyals plus prison for sensitive data disclosure

Key obligations

Obtain consent before processing unless an exception applies
Provide a privacy notice of purpose and rights
Honor access, correction and deletion rights
Register with the authority and appoint a data protection officer where required
Meet conditions for cross-border transfers and report breaches

Local guidance

Apply the PDPL overseen by SDAIA
Meet the conditions before transferring data outside the Kingdom
Document consent and provide notices in Arabic
Take special care with sensitive data given criminal exposure

How ConsentX helps

Consent capture before processing
Geo-aware banner for visitors in Saudi Arabia
Rights request workflow with evidence
Consent receipts for audit
Region rule engine tuned for Saudi Arabia

Get started free

yoursite.com

المملكة العربية السعودية

We value your privacy

We ask for your consent before any non-essential cookie, with the rules that apply in your region.

Allow allReject non-essentialManage preferences

Consent recorded

sha256 · chain ok

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get المملكة العربية السعودية ready with ConsentX

Geo-aware banners, prior-script blocking, DSAR and tamper-evident evidence.

Get started free Book a demo

How to comply with المملكة العربية السعودية using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under المملكة العربية السعودية.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that المملكة العربية السعودية requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a المملكة العربية السعودية audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.