Saudi Arabia PDPL Compliance with ConsentX

What is the Saudi Personal Data Protection Law?

The Saudi Personal Data Protection Law, commonly referred to as the Saudi PDPL, establishes rules for protecting personal data and regulating its processing.

The law defines personal data broadly. It covers information that can identify an individual directly or indirectly, including names, identification numbers, addresses, contact numbers, license numbers, personal assets, bank and credit-card numbers, photographs, videos, and other information of a personal nature.

Processing is also defined broadly and includes activities such as:

• Collection
• Recording
• Storage
• Organization
• Structuring
• Modification
• Retrieval
• Use
• Disclosure
• Transfer
• Sharing
• Destruction

This means that organizations should consider PDPL compliance throughout the complete personal-data lifecycle.

When did the Saudi PDPL come into force?

The Saudi PDPL came into force on 14 September 2023.

The framework was subsequently supplemented by its Implementing Regulations and related regulatory instruments. SDAIA's current compliance materials treat the PDPL and Implementing Regulations as the core framework governing personal-data protection in Saudi Arabia.

Organizations should therefore assess compliance against the current law and implementing requirements rather than treating the PDPL as an upcoming regulation.

Does the Saudi PDPL apply to companies outside Saudi Arabia?

Yes, in certain circumstances.

Article 2 applies the law to processing personal data relating to individuals residing in Saudi Arabia when that processing is carried out by a party outside the Kingdom.

This can be particularly relevant to international businesses using:

• Global CRM platforms
• International cloud infrastructure
• Analytics services
• Advertising platforms
• Global customer-support systems
• International HR platforms
• SaaS applications
• Marketing automation systems

Organizations outside Saudi Arabia should therefore assess whether their processing activities fall within the territorial scope of the PDPL.

What is personal data under the Saudi PDPL?

Personal data includes information that can identify an individual specifically or make identification possible directly or indirectly.

Examples include:

• Name
• National identification number
• Address
• Telephone number
• Email address
• License numbers
• Registration information
• Personal asset information
• Bank-account information
• Credit-card information
• Photographs
• Videos
• Other identifying information

The law is technology-neutral, meaning organizations should not assume that only traditional databases or paper records fall within scope.

What is sensitive personal data?

Sensitive personal data receives additional protection under the Saudi PDPL framework.

Sensitive information can include data relating to matters such as:

• Racial or ethnic origin
• Religious, philosophical, or political beliefs
• Criminal records or proceedings
• Biometric information used for identification
• Genetic information
• Health information
• Information concerning parentage

The regulatory framework imposes additional restrictions on processing sensitive personal data. For example, the legitimate-interest basis cannot be used for processing sensitive personal data.

Legal bases for processing under the Saudi PDPL

The Saudi PDPL does not require consent for every processing activity.

Article 5 establishes consent as the general rule, while Article 6 identifies circumstances where processing is not subject to that consent requirement. These include situations where:

• Processing serves the actual interests of the data subject but communication is impossible or difficult
• Processing is required under another law
• Processing is necessary to implement a previous agreement to which the data subject is a party
• A public entity processes data for security or judicial requirements
• Processing is necessary for the legitimate interests of the controller, provided data-subject rights and interests are not prejudiced and sensitive data is not processed

The Implementing Regulations provide additional controls and conditions.

Organizations should therefore document the legal basis for each processing activity instead of assuming that all processing must be based on consent.

Consent under the Saudi PDPL

Where consent is the applicable legal basis, organizations must obtain consent in accordance with the PDPL and Implementing Regulations.

Article 5 provides that personal data generally cannot be processed, or its purpose changed, without the data subject's consent except in circumstances provided by the law. It also establishes the data subject's ability to withdraw consent.

A compliant consent process should be designed to demonstrate:

• Who provided consent
• When consent was provided
• What processing purposes were presented
• What categories of data were involved
• What choices were selected
• Which version of the notice or consent interface was displayed
• Whether consent was subsequently withdrawn

Consent should be specific to the relevant processing and should not be used as a blanket authorization for unrelated purposes.

Can consent be made mandatory to receive a service?

Not always.

Article 7 provides that consent may not be made a condition for providing a service or benefit unless the service or benefit is directly related to the processing for which consent is being obtained.

Organizations should therefore review whether consent requests are genuinely optional or whether they are being improperly tied to unrelated services.

Withdrawal of consent

Data subjects can withdraw consent at any time where processing is based on consent, subject to the applicable regulatory controls.

Organizations should therefore provide a practical mechanism for users to:

• Review their consent choices
• Withdraw consent
• Change selected purposes
• Stop applicable marketing
• Update preferences

Consent withdrawal should also be reflected in downstream systems where continued processing depends on that consent.

Privacy notices under the Saudi PDPL

Controllers must provide a privacy policy and make it available to data subjects before collecting their personal data.

The privacy policy must address matters including:

• Purpose of collection
• Personal data being collected
• Methods used for collection
• Processing
• Storage
• Destruction
• Data-subject rights
• How those rights can be exercised

Article 13 also requires organizations collecting data directly from data subjects to provide additional information, including the legal basis, purpose, mandatory and optional data, relevant recipients, international transfers, potential consequences of not providing the data, and applicable rights.

A Saudi PDPL privacy notice should therefore be specific to the organization's actual processing operations rather than being a generic privacy statement.

Data minimization and purpose limitation

The PDPL requires personal-data collection to be connected to the controller's purposes.

The law requires the amount of personal data collected to be appropriate and limited to the minimum necessary to achieve the collection purpose. When personal data is no longer necessary for its original purpose, collection should cease and previously collected data should be destroyed, subject to applicable requirements.

Organizations should regularly review:

• Which fields are collected
• Why each field is collected
• Whether optional information is genuinely necessary
• Whether data is reused for another purpose
• Whether retention periods remain justified
• Whether information can be anonymized or pseudonymized

Data accuracy

Controllers must take sufficient steps to verify that personal data is:

• Accurate
• Complete
• Current
• Relevant to the purpose for which it was collected

The PDPL also requires controllers to communicate corrections, completions, or updates to other entities to which the personal data has been transferred, subject to applicable requirements.

Data-subject rights under the Saudi PDPL

The Saudi PDPL provides individuals with several rights concerning their personal data.

Right to be informed. Individuals have the right to information concerning the legal basis and purpose of collecting their personal data.

Right of access. Data subjects can request access to personal data held by the controller, subject to applicable limitations.

Right to obtain data. Individuals can request their personal data in a readable and clear format, subject to applicable controls.

Right to correction. Individuals can request correction, completion, or updating of their personal data.

Right to destruction. Individuals may request destruction of personal data when it is no longer needed, subject to the exceptions and retention requirements established by the law.

Right to withdraw consent. Where processing is based on consent, the data subject can withdraw that consent.

Right to complain. A data subject may submit a complaint to the competent authority concerning implementation of the PDPL and its regulations.

Right to compensation. Individuals who suffer damage resulting from qualifying violations may seek proportionate compensation for material or moral damage through the competent court.

Data disclosure under the Saudi PDPL

Controllers generally cannot disclose personal data except in circumstances permitted by the PDPL.

Permitted circumstances can include:

• Data-subject consent
• Data collected from a publicly available source
• Certain public-entity requirements
• Public-health or public-safety situations
• Protection of life or health
• Processing that prevents identification
• Certain legitimate-interest situations where sensitive data is not processed

Additional restrictions apply to disclosure where it could affect national security, international relations, criminal investigations, individual safety, another person's privacy, professional obligations, or other protected interests.

Direct marketing under the Saudi PDPL

The Saudi PDPL contains specific requirements for advertising and awareness materials sent through personal communication channels.

Except for specified public-entity awareness materials, controllers generally cannot use personal communication channels such as email or post to send advertising or awareness materials without prior consent.

The sender must also provide a clear mechanism through which the recipient can request that such communications stop.

The PDPL separately provides that personal data may be processed for marketing purposes where it was collected directly from the data subject and consent was obtained, subject to the law and regulations. Sensitive data is excluded from this marketing provision.

Cookies and tracking technologies

The Saudi PDPL should be considered when websites and applications use cookies, pixels, SDKs, advertising technologies, analytics tools, and other tracking technologies that process personal data.

Organizations should assess:

• Whether a cookie or tracker processes personal data
• What information is collected
• The purpose of processing
• The applicable legal basis
• Whether consent is required
• Whether third parties receive the information
• Whether the information leaves Saudi Arabia
• Whether the technology is used for marketing or profiling
• How long the information is retained

A cookie banner alone does not establish complete PDPL compliance. Organizations should combine consent management with privacy notices, data governance, vendor management, security controls, and data-subject rights processes.

Data Protection Officer under the Saudi PDPL

The Saudi PDPL and Implementing Regulations provide for appointment of a Personal Data Protection Officer (DPO) in specified circumstances.

SDAIA has issued dedicated rules concerning the appointment of personal-data protection officers. DPO requirements should be assessed based on the organization's activities and the circumstances specified by the Implementing Regulations.

Where required, the DPO can support activities such as:

• Monitoring compliance
• Advising on privacy requirements
• Supporting data-protection policies
• Monitoring data-subject rights
• Supporting impact assessments
• Coordinating with SDAIA
• Supporting breach-response processes
• Monitoring processing records

Organizations should not assume that every controller has the same DPO requirement.

Data Protection Impact Assessments

The Saudi PDPL requires controllers to conduct an impact assessment of personal-data processing in relation to products or services, based on the nature of the controller's activity and the applicable regulatory requirements.

An assessment should consider factors such as:

• Purpose of processing
• Type and volume of personal data
• Data-subject categories
• Processing methods
• Potential risks
• Security measures
• Data retention
• Third-party disclosures
• International transfers
• Measures to reduce identified risks

Organizations should integrate privacy impact assessments into product and service development rather than treating them as a purely retrospective compliance exercise.

Security of personal data

Controllers must implement organizational, administrative, and technical measures to protect personal data, including during transfers.

SDAIA's current guidance identifies principles including integrity and confidentiality, requiring appropriate security controls to protect personal data against loss, destruction, or damage.

Security measures may include:

• Access controls
• Authentication
• Encryption
• Monitoring
• Secure storage
• Vulnerability management
• Incident response
• Employee confidentiality controls
• Vendor security assessments
• Backup and recovery procedures
• Data minimization
• Secure deletion

The appropriate controls should reflect the nature and risks of the processing.

Personal-data breach notification

Controllers must notify the competent authority when they become aware of a breach, damage, or illegal access to personal data, in accordance with the applicable regulatory requirements.

Controllers must also notify affected data subjects where the incident could cause damage to their data or prejudice their rights and interests.

Organizations should maintain a documented breach-response process covering:

• Detection
• Containment
• Initial assessment
• Risk analysis
• Documentation
• Regulatory notification
• Data-subject notification where required
• Remediation
• Post-incident review

The applicable notification deadlines and thresholds should be assessed against the current Implementing Regulations and SDAIA procedures.

Records of processing activities

Controllers must maintain records of personal-data processing activities in accordance with the law and Implementing Regulations.

SDAIA's current guidance states that processing-activity records should be maintained for five years after cessation of each processing activity.

Records should contain information including:

• Controller contact details
• Processing purposes
• Categories of data subjects
• Entities to which data has been or will be disclosed
• International transfers
• Expected retention period

These records should be available to the competent authority when requested.

National Register of Controllers

SDAIA maintains a National Register of Controllers through the National Data Governance Platform.

Current registration rules identify categories of controllers that must register, including:

• Public entities
• Controllers whose main activity is based on personal-data processing
• Controllers processing sensitive data
• Individuals processing personal data for purposes beyond personal or family use

SDAIA states that the National Register is intended to support monitoring and follow-up of controllers and their compliance with the PDPL and Implementing Regulations. SDAIA also provides registration processes for external organizations.

Controllers and processors

The Saudi PDPL distinguishes responsibilities between organizations determining how and why personal data is processed and organizations processing data on their behalf.

Controllers must select processors that provide necessary guarantees for implementing the PDPL and Implementing Regulations and must monitor processor compliance.

Organizations should therefore conduct appropriate processor due diligence and ensure contracts address:

• Processing instructions
• Confidentiality
• Security
• Sub-processing
• Data retention
• Data deletion
• Data-subject requests
• Breach management
• International transfers
• Audit and compliance obligations

International data transfers

The Saudi PDPL contains specific provisions governing transfers and disclosures of personal data outside Saudi Arabia.

Article 29 permits transfers or disclosures outside the Kingdom in specified circumstances and imposes conditions concerning:

• National security
• Vital interests of the Kingdom
• Adequate protection
• Data minimization

The law also provides an exception for extreme necessity involving the life or vital interests of a data subject or preventing, examining, or treating disease.

The separate Regulation on Personal Data Transfer Outside the Kingdom provides additional requirements and mechanisms for international transfers. SDAIA identifies this regulation as part of the current Saudi data-protection framework. Organizations using international cloud providers, analytics platforms, CRM systems, advertising services, or global SaaS infrastructure should therefore map their international data flows.

Data retention and destruction

Organizations should not retain personal data indefinitely.

The PDPL requires controllers to stop collecting personal data and destroy previously collected data when it is no longer necessary for the purpose for which it was collected, subject to applicable requirements and exceptions.

Organizations should establish retention schedules covering:

• Customer information
• Employee data
• Marketing data
• Consent records
• Analytics information
• Support records
• Financial records
• Legal records
• Data-subject requests
• Processing records

SDAIA also publishes guidance concerning personal-data destruction, anonymization, and pseudonymization.

Health and credit data

Certain categories of personal data receive additional regulatory treatment.

The PDPL provides for additional controls concerning health data, including restrictions on access and processing by employees and workers to the minimum extent necessary for providing health services or health-insurance programs.

The law also contains additional requirements for credit data, including requirements concerning explicit consent and notification in specified circumstances.

Organizations operating in healthcare, financial services, insurance, credit, and related sectors should therefore consider the PDPL together with sector-specific Saudi requirements.

Who enforces the Saudi PDPL?

The Saudi Data & AI Authority (SDAIA) is responsible for overseeing implementation of the PDPL and its amendments and operates the National Data Governance Platform.

SDAIA provides organizations with:

• PDPL legislation
• Implementing Regulations
• International-transfer regulations
• Compliance guidance
• Controller registration
• DPO guidance
• Processing-record guidance
• Breach-related services
• Data-protection resources

The current SDAIA knowledge center identifies the PDPL, Implementing Regulations, and international-transfer regulation as core elements of the Saudi data-protection framework.

Saudi PDPL compliance checklist

Organizations operating in Saudi Arabia should consider the following.

• Determine whether the PDPL applies
• Map personal-data processing
• Identify controllers and processors
• Document processing purposes
• Identify the applicable legal basis
• Review consent mechanisms
• Ensure explicit consent is obtained where required
• Provide an appropriate privacy policy
• Provide required collection information
• Identify sensitive personal data
• Review direct-marketing practices
• Establish data-subject rights procedures
• Provide consent withdrawal mechanisms
• Review data-retention periods
• Implement secure destruction procedures
• Maintain processing activity records
• Assess DPO requirements
• Assess National Register requirements
• Conduct required impact assessments
• Implement security controls
• Establish breach-response procedures
• Review international data transfers
• Implement applicable transfer safeguards
• Review processor contracts
• Scan websites for cookies and trackers
• Identify marketing and analytics technologies
• Prevent applicable technologies from operating before required consent
• Maintain auditable consent records