Guide to the Saudi Personal Data Protection Law
Saudi Arabia · Guideline · Saudi Data and AI Authority (SDAIA)
Our summary
This handbook provides practical guidance on complying with the Saudi Personal Data Protection Law (PDPL), addressing key compliance requirements such as data discovery, legal bases for processing, governance structures, and individual rights. It applies to all organizations operating in Saudi Arabia that process personal data and details how to establish accountability, implement safeguards, and manage data breaches. The guide aligns data protection with the Kingdom's Vision 2030 objectives of digital transformation and developing a data-driven economy.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
12 sections
Jump to a chapter
Section A Data protection and Vision 2030
Data protection supports the Kingdom's Vision 2030 goals by enabling secure digital transformation, building public trust in e-government services, fostering innovation and entrepreneurship, and ensuring reliable data for policy and business decisions. The Saudi Data and AI Authority oversees personal information handling, with processing defined as any use of personal data.
Section B Starting your data
Organizations must understand the PDPL's core principles and legal bases for processing, perform data discovery and assessment, select appropriate legal bases, establish processing records, and publish privacy notices. They must appoint a Data Protection Officer where applicable, define governance structures and roles, develop data handling and breach response policies, handle individual rights requests swiftly and transparently, and provide regular employee training. Organizations must identify and manage personal data breaches with notification to the competent authority and affected individuals, implement technical and organizational safeguards, conduct regular audits, share data within the Kingdom only with appropriate protections, and ensure adequate safeguards when transferring personal data outside the Kingdom considering differing protection standards.
Section 01 Understanding the PDPL and the Implementing Regulations
Describes seven embedded principles for all organizations processing personal data: lawfulness and fairness, limiting to stated purposes, collecting only needed information, keeping data accurate and current, not retaining data longer than necessary, protecting data against loss, and maintaining evidence of compliance. Individuals have rights including being informed about data collection, accessing their data, receiving it in clear form, correcting errors, requesting erasure, and withdrawing consent.
Section 02 Understanding the Personal
Individuals have the right to request correction, completion or updates to their personal data, the right to request erasure and the right to withdraw consent at any time. Organizations must conduct data discovery to identify and classify personal data, map data flows, select appropriate legal bases (with consent being freely given without misleading methods and legitimate interests requiring assessment and not applying to sensitive data), maintain comprehensive processing records accessible to competent authorities, and publish easily accessible privacy notices that include data collection, processing purposes, legal bases, data sharing, retention periods and individual rights.
Section 03 Establishing Accountability and Governance
Some organizations must appoint a Data Protection Officer as specified in the Implementing Regulations, who should possess expertise in data protection law and practices and serve as an internal advisor; organizations should establish a governance structure with clear roles, responsibilities and reporting lines, including a data protection steering committee, policies on data handling and consent, impact assessments for new projects and sensitive data processing, and monitoring and auditing mechanisms. The DPO must oversee creation and regular review of data protection policies and procedures, establish audit routines, and design staff training programs on data protection responsibilities. Individuals can revoke consent at any time, requiring organizations to cease processing immediately; organizations must promptly acknowledge requests, verify identity, provide requested data in clear format, correct inaccurate information without delay, and comply with erasure requests and consent withdrawal by stopping processing and deleting data.
Section 04 Conducting Impact Assessments
Organizations should use impact assessments, a structured method for recognizing and reducing dangers in personal data handling, to proactively identify threats, safeguard individuals' interests, and show they follow data protection rules. SDAIA provides an impact assessment service through the National Data Governance Platform to help entities make decisions about minimizing processing dangers, with further specifications available in the Implementing Regulations.
Section 05 Privacy by Design and Default
Privacy by design and default is strongly recommended for organizations to incorporate throughout their personal data handling process, weaving data protection into organizational processes, products and services from the beginning. Organizations should implement consent management systems that explicitly inform individuals about data processing and obtain consent before collecting, sharing or using personal data; organizations may anonymize personal data for research purposes. Organizations must encrypt all personal data at rest and during transmission, and use pseudonymization controls where applicable.
Section 06 Implementing Personal Data
Organizations must report personal data breaches in cases determined by the Implementing Regulations. Breach handling procedures should include establishing an incident response team, detecting and assessing breaches, classifying incidents by severity, notifying the competent authority if the breach may cause harm to personal data or data subject rights, notifying affected individuals if the breach may damage their data or conflict with their rights, and conducting post-incident documentation and analysis.
Section 07 Implementing Technical and
Requires implementation of both technological safeguards, such as encryption and access controls, and administrative protections, such as employee training and incident response plans. These measures work together to protect personal data throughout the organization and its supply chain.
Section 08 Sharing Personal Data within the Kingdom
Organizations must comply with PDPL requirements and implement appropriate technical and organizational safeguards when transferring personal data to other parties within the Kingdom. The example illustrates how a bank should conduct legal reviews, establish lawful bases for disclosure, monitor data-sharing arrangements, maintain access controls, and communicate transparently with customers about data sharing practices.
Section 09 Transferring Personal Data outside the Kingdom
Transferring personal data outside the Kingdom is subject to specific requirements under the PDPL and Implementing Regulations. When transferring to non-adequate jurisdictions, organizations must review whether the transfer impacts national security or vital interests, whether only minimal necessary data is transferred, whether data subject rights are considered, whether the transfer purpose is established, whether appropriate safeguards like binding corporate rules or standard contractual clauses are in place, and whether a risk assessment has been undertaken.
Section 10 Monitoring and Auditing
Organizations must conduct ongoing monitoring and auditing to ensure continuous compliance with the PDPL. This includes regular internal monitoring of staff adherence to data protection policies, tracking regulatory updates and court rulings, monitoring for potential data breaches, conducting external audits by third parties, maintaining access logs to detect unauthorized data access, performing incident response testing to evaluate readiness, and implementing supplier management programs with data protection requirements.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 14 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Risk classification, not covered
- Prohibited practices, not covered
Data and privacy 3 of 4
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 3 of 4
- Registration and notification, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Section B 6 controls
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should gain detailed knowledge of the PDPL's core principles, legal requirements, obligations, lawful bases for processing, individual rights and rules for transferring data outside Saudi Arabia.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should conduct data discovery to identify all personal data they collect, store and process in structured and unstructured formats, whether electronic or physical, to understand data location, access and usage.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should interview relevant staff, review data flows and use automated tools to enhance the quality of their data discovery process.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should select an appropriate legal basis for processing from those allowed under the PDPL, based on the purpose of the processing activity.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should create and keep current records documenting purposes of processing, data categories, recipients, transfers, retention periods and security measures.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should publish privacy notices to inform individuals about data collection and processing activities.
Section 01 7 controls
- ObligationApplies to: AnyoneDrafted by the Index
Any organization must handle personal data in a manner that is both equitable and lawful, with openness about how it is used.
- ObligationApplies to: AnyoneDrafted by the Index
Any organization must limit processing to specific, lawful purposes only.
- ObligationApplies to: AnyoneDrafted by the Index
Any organization must process only the minimum personal data necessary to accomplish the stated processing purpose.
- ObligationApplies to: AnyoneDrafted by the Index
Any organization must keep personal data current and implement controls to identify and fix inaccurate information.
- ProhibitionApplies to: AnyoneDrafted by the Index
Any organization must not retain personal data beyond the period needed for its stated purpose.
- ObligationApplies to: AnyoneDrafted by the Index
Any organization must put in place sufficient security measures to guard personal data from loss, destruction or damage.
- RightApplies to: OthersDrafted by the Index
Individuals have the right to learn the lawful basis and purpose for collection of their personal data.
Section 02 3 controls
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must understand the types of personal data they collect, process and store to assess data protection risks and implement appropriate safeguards.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must determine the purposes and legal bases for which personal data is used and establish data retention periods through data discovery.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must identify and map all personal data sources, classify data types including sensitive data requiring additional protection, and trace data flows throughout their systems.
Section 03 4 controls
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must appoint a Data Protection Officer when the Implementing Regulations require it.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should equip the Data Protection Officer with adequate resources, training and support and promote their ongoing professional development in data protection matters.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should encourage the Data Protection Officer to work actively across departments including legal, IT, HR and marketing to provide data protection guidance.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should implement a data protection governance structure across the entire company that includes accountability mechanisms, documented policies, defined procedures and training for all employees and stakeholders.
Section 04 3 controls
- ObligationApplies to: ProviderDrafted by the Index
Organizations should conduct systematic impact assessments to identify and evaluate data protection risks associated with their personal data processing activities.
- ObligationApplies to: ProviderDrafted by the Index
Organizations should document their impact assessment findings, recommendations and decisions, making the assessment report available for review by the competent authority.
- ObligationApplies to: ProviderDrafted by the Index
Organizations should review and update their impact assessments periodically or whenever significant changes are made to their processing activities.
Section 05 1 control
- ObligationApplies to: ProviderDrafted by the Index
Organizations should embed data protection considerations throughout all stages of personal data processing, from initial development onwards, to build trust and ensure ongoing compliance.
Section 06 5 controls
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must establish clear procedures for responding to personal data breaches as specified in the Implementing Regulations.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must promptly notify the competent authority if a personal data breach potentially results in or leads to harm to the data or to affected individuals, or conflicts with their rights or interests.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations must thoroughly record all actions taken in response to a personal data breach.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should conduct post-incident reviews following a personal data breach to prevent similar occurrences in the future.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should collaborate with relevant competent authorities if a personal data breach involves criminal activity to investigate the incident and pursue necessary legal action.
Section 07 1 control
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should implement technical and organizational measures together, including encryption, access controls, cybersecurity systems, employee training and incident response plans, to protect personal data across the organization and its supply chain.
Section 08 6 controls
- ObligationApplies to: AnyoneDrafted by the Index
When transferring personal data within the Kingdom to third parties, organizations must comply with PDPL requirements and implement appropriate technical and organizational safeguards.
- ObligationApplies to: AnyoneDrafted by the Index
Before sharing customer personal data with a third-party processor, organizations should conduct legal and compliance reviews to ensure lawful basis for disclosure, necessary safeguards and monitoring arrangements are in place.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should restrict employee access to personal data to only what is necessary for their respective roles through strict access controls.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should conduct regular data protection and security training for employees regarding lawful handling and disclosure of customer personal data.
- ObligationApplies to: AnyoneDrafted by the Index
Organizations should inform customers in privacy notices about personal data sharing practices, including the purpose, departments involved and safeguards in place.
- ObligationApplies to: AnyoneDrafted by the Index
Once processing by a third-party processor is complete, organizations should delete or return personal data to the controller.
Section 09 8 controls
- ObligationApplies to: ControllerDrafted by the Index
Organizations should evaluate whether transferring personal data outside the Kingdom will affect the country's national security or vital interests.
- ObligationApplies to: ControllerDrafted by the Index
Organizations should transfer only the minimum amount of personal data necessary to accomplish the processing purpose.
- ObligationApplies to: ControllerDrafted by the Index
Organizations should consider the rights of data subjects when arranging transfers beyond the Kingdom's borders.
- ObligationApplies to: ControllerDrafted by the Index
Organizations should establish and document the purpose for transferring personal data across borders.
Change history
No changes recorded since we began monitoring this policy.