Knowledge Pack — KSA Personal Data Protection Law (PDPL)

Knowledge Pack — KSA Personal Data Protection Law (PDPL)

Scope

Saudi Arabia's Personal Data Protection Law (PDPL) was enacted by Royal Decree M/19 dated 9/2/1443H (September 2021) and became operative for most entities in September 2023 following a phased rollout supervised by:

• SDAIA — Saudi Data and Artificial Intelligence Authority (policy and enforcement)
• NDMO — National Data Management Office (implementing regulations and technical guidance)

The PDPL applies to:

• Any entity (public or private) that processes personal data of individuals located in Saudi Arabia at the time of processing.
• Extra-territorial: foreign entities processing KSA residents' data to offer goods/services or to monitor behavior in KSA.
• Excluded: data processed for personal/family purposes; national security, crime, or judicial processing by competent authorities; deceased persons' data (except where linked to living persons).

Key Definitions

Lawful Bases for Processing

Unlike GDPR, the KSA PDPL uses a narrower set of lawful bases:

1. Controller's legitimate interest — processing that does not override data subject's interests; proportionality required.
2. Public interest — government and public sector tasks.
3. Legal obligation — required by applicable Saudi law.
4. Contract — necessary to perform a contract to which the data subject is a party.
5. Vital interests — protect life or health.
6. Consent — required specifically for sensitive data and for direct marketing; otherwise not the primary basis.

Sensitive data processing

Requires explicit consent of the data subject plus one of the following additional grounds:

• Legal obligation or judicial procedure
• Legitimate public interest established by regulation
• Protection of vital interests when data subject is unable to consent

Data Subject Rights

• Response deadline: 30 days (extendable once with notice).
• NDMO may issue further guidance on specific rights implementation.

Consent Requirements

• Must be written (or electronic equivalent) when required.
• Explicit for sensitive data.
• Specific to the purpose — bundled/blanket consent does not satisfy the requirement.
• Withdrawable — controllers must maintain mechanisms for withdrawal.
• Consent from minors under 18 requires guardian consent.

Cross-Border Data Transfers

Transfer of personal data outside Saudi Arabia is prohibited unless:

1. The destination country provides adequate protection — per NDMO adequacy list (currently being developed; GDPR-equivalent jurisdictions used as benchmark).
2. Contractual safeguards approved by NDMO (model clauses or binding corporate rules).
3. Explicit consent of the data subject for the specific transfer and its risks.
4. Transfer necessary for contract performance, judicial proceedings, or legal claims.
5. Transfer necessary to protect vital interests when data subject is unable to consent.
6. The transfer is in the public interest established by law.

Controllers must document transfer basis and obtain NDMO approval for certain categories.

Data Breach Obligations

• Notify NDMO within 72 hours of becoming aware of a breach likely to harm data subjects.
• Notify affected data subjects without undue delay when the breach may directly affect their rights or interests.
• Maintain internal incident register.
• Implement preventive technical and organizational security measures.

Security Requirements

• Implement technical and organizational security measures proportionate to the nature and risk of processing.
• Physical, administrative, and technical safeguards required.
• Data Processing Agreements (DPAs) with processors mandatory; processors must provide equivalent security guarantees.
• Retention limitation: data must be deleted once the purpose is achieved unless retention is required by law.

Penalties

• Criminal penalties possible for intentional violations causing harm.
• SDAIA may publish violator names publicly (naming and shaming).
• Repeat violations trigger doubled fines.

Sector-Specific Overlays

Health data and financial data are sensitive data under PDPL and require heightened protections.

Data Localization

• KSA does not impose a blanket data-localization requirement under PDPL.
• However, sector-specific regulations (particularly SAMA, MOH, and CITC) impose localization requirements for certain categories of regulated data (financial records, health records, telecom data).
• Cloud computing and SaaS agreements must address localization obligations per sector.

Compliance Checklist

• Data mapping: inventory all personal data flows in KSA operations
• Identify and document lawful basis for each processing activity
• Obtain explicit consent for sensitive-data processing
• Review and update privacy notices (Arabic mandatory; bilingual recommended)
• Establish consent-withdrawal mechanisms
• Put Data Processing Agreements in place with all processors
• Assess cross-border transfer mechanisms for data leaving KSA
• Implement 72-hour breach notification procedure
• Establish data subject rights request-handling process
• Check sector-specific data localization obligations

Comparison with GDPR

Caveats & Currency

The PDPL's implementing regulations and NDMO guidance have been issued in phases. The adequacy list, approved model clauses, and sector-specific guidance are still developing as of 2025. Consult current NDMO publications before advising. SAMA, CITC, and MOH layered obligations require separate verification per sector.

Related Skills

• [[kb-data-privacy-gdpr]]
• [[kb-data-privacy-egypt]]
• [[kb-data-privacy-uae-pdpl]]
• [[kb-fintech-licensing-cma-ksa]]
• [[kb-healthcare-regulation-mena]]
• [[draft-data-processing-agreement]]
• [[draft-privacy-policy]]