Guide to the Saudi Personal Data Protection Law for Controllers and Processors
Saudi Arabia · Guideline · Saudi Data and AI Authority (SDAIA)
Our summary
This non-binding guidance document explains the Saudi Personal Data Protection Law (PDPL) and how it applies to organizations that handle personal data. It clarifies key concepts such as what constitutes personal data, sensitive data, and the roles of data controllers and processors. The guide helps individuals and organizations understand their obligations under the PDPL, which is the primary data protection law in Saudi Arabia.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
PDPL
Personal data means information that can directly or indirectly identify an individual, including opinions and inferences attached to identifiable individuals regardless of accuracy, and covers electronic or non-electronic, structured or unstructured data in any volume. Sensitive data includes information revealing racial or ethnic origin, religious or political beliefs, criminal history, biometric data used for identification, genetic data, health data, or unknown parentage, and cannot be processed on the basis of legitimate interest or for marketing even with consent, with restrictions on non-anonymized sensitive data for scientific or research purposes; sensitive data requires additional safeguards and explicit consent if relying on consent. Pseudonymized data remains personal data and serves as a security measure, while anonymized data with direct and indirect identifiers permanently removed falls outside the law, though the anonymization process itself is processing subject to the law; processing encompasses any operation on personal data by any means including collecting, recording, storing, organizing, modifying, using, disclosing, sharing and erasing, done manually or automatically.
PDPL
The law applies to processing of personal data within the Kingdom by any entity, and to processing of personal data of individuals residing in the Kingdom (including citizens, residents, temporary workers, tourists and others staying there for any reason) from any party anywhere. It covers personal data stored in the Kingdom even after individuals leave the country. Entities outside the Kingdom that process personal data of Kingdom residents, or store data there on behalf of Kingdom-based parties, must also comply.
PDPL
PDPL?
A Controller decides the purposes and manner of processing and bears ultimate responsibility with broader obligations, while a Processor processes data on behalf of a Controller without making such decisions; Controllers must ensure their Processors comply. The PDPL became effective on 14 September 2023, with a one-year grace period until 14 September 2024 during which the Competent Authority will not impose penalties, though organisations must take measures to achieve compliance, and the Competent Authority may lengthen the grace period at its sole discretion if it deems reasons appropriate, though this does not exempt compliance with other applicable laws. SDAIA acts as the Competent Authority for two years, with functions including monitoring compliance, providing consultations, and investigating complaints.
PDPL
Individuals have rights to be informed of lawful bases and purposes, access their data, request it in readable format, request corrections or destruction, and withdraw consent. The PDPL establishes seven key principles: lawfulness and transparency require collection on lawful bases; purpose limitation requires specified and documented purposes; data minimization prohibits unnecessary collection; storage limitation restricts processing duration unless legally required; accuracy requires regular review and update opportunities; integrity and confidentiality require adequate technical and organisational protections; accountability requires appropriate measures and records. Controllers must identify and document lawful bases for each purpose, not collect data without formally defined purposes, provide privacy notices when sharing, establish data protection policies and procedures, enforce them, and train employees regularly; announcing personal data in public without lawful basis is prohibited.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 5 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 2 of 4
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 1 of 6
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 10 are shown.
PDPL 8 controls
- ObligationApplies to: AnyoneDrafted by the Index
Any entity must ensure that processing of personal data is conducted fairly, lawfully and transparently in accordance with the law.
- RightApplies to: OthersDrafted by the Index
Individuals may learn the lawful grounds and purposes for collecting their personal data.
- RightApplies to: OthersDrafted by the Index
Individuals may ask for their personal data to be supplied in a legible and intelligible format.
- RightApplies to: OthersDrafted by the Index
Individuals may ask for their personal data to be fixed if it is wrong, filled in if it is incomplete, or brought up to date if it is stale.
- RightApplies to: OthersDrafted by the Index
Individuals may ask for their personal data to be destroyed, subject to requirements of the law.
- RightApplies to: OthersDrafted by the Index
Individuals may at any time revoke consent they gave for processing of their personal data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must gather personal data only on a lawful basis, always in accordance with the kingdom's laws, and must ensure individuals understand how their data is handled.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must specify the reason for processing personal data, document it in processing records, refrain from collecting more data than needed, only process data for as long as required unless other laws mandate longer storage, and regularly review data to ensure it remains correct.
PDPL? 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must ensure that any processors they engage fully comply with the law.
- Applies to: AnyoneDrafted by the Index
Processing of personal data for personal or family purposes that is not published or disclosed to others is excluded from the scope of the law.
Change history
No changes recorded since we began monitoring this policy.