Saudi Arabia

The Saudi Arabia Personal Data Protection Law (PDPL) is the leading legislation of its kind in the Kingdom of Saudi Arabia that addresses the processing and management of personal data by both private and public entities. Passed into law under the Royal Decree No. M/19, the law brings the Kingdom in line with international standards on privacy, like GDPR, through Saudi Vision 2030. Regulated and enforced by the Saudi Data and AI Authority (SDAIA), the PDPL is an extraterritorial legislation that covers any organization around the world that processes the data of people who reside in the Kingdom of Saudi Arabia. Under the law, the residents of the Kingdom have a right to access, modify, or destroy their data, while the enterprises in the Kingdom must obtain consent of the data subjects, restrict data collection, report a breach within 72 hours, and conduct a thorough risk assessment for any transfer of data outside the Kingdom. Failure to comply with the framework attracts an administrative fine of up to SAR 5,000,000 and a jail term of up to two years for any unauthorized release of sensitive data.