CevroSaudi Arabia: Saudi PDPL and what it requires
Personal Data Protection Law (PDPL), Royal Decree M/19: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Saudi Data & AI Authority (SDAIA).
Key requirements at a glance
| Registration with the regulator | Depends on thresholds or circumstances |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines of up to SAR 5 million per violation (doubled for repeat violations); up to 2 years' imprisonment and/or SAR 3 million for disclosing sensitive data with intent to harm or for personal gain.
What to know in practice
Fully enforced since 14 September 2024. Notify SDAIA within 72 hours of becoming aware of a breach, through the National Data Governance Platform. Transfers outside the Kingdom are governed by a separate Transfer Regulation. Controller registration and DPO duties depend on rules SDAIA issues.
The security duty
Under Art. 19: Controller must implement all necessary organisational, administrative and technical measures to protect personal data, including during transfer. Source: published text, checked 2026-10.
How Cevro helps
- Maps Saudi PDPL to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in Art. 19.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Saudi Arabia?
Saudi Data & AI Authority (SDAIA) oversees Personal Data Protection Law (PDPL), Royal Decree M/19.
Is breach notification mandatory under Saudi PDPL?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Saudi Arabia restrict cross-border data transfers?
Yes. Moving personal data out of Saudi Arabia is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Saudi PDPL?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Saudi Arabia?
Fines of up to SAR 5 million per violation (doubled for repeat violations); up to 2 years' imprisonment and/or SAR 3 million for disclosing sensitive data with intent to harm or for personal gain.