How the PDPL applies to foreign companies processing personal data of people in Saudi Arabia, and a staged plan covering records, consent, transfers and breaches.
Saudi Arabia's Personal Data Protection Law came into force in September 2023, with enforcement from September 2024, and is supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). It applies to processing of personal data in the Kingdom and to processing abroad of data relating to individuals in the Kingdom. Transfers of personal data outside the Kingdom are allowed only under the conditions in the law and its transfer regulation.
Before stage one
Compliance starts with knowing what personal data the Saudi business touches: employees, customers, tenants, website visitors and suppliers' staff. Foreign groups often assume their global privacy programme covers Saudi Arabia, but the PDPL has its own legal bases, record-keeping, registration and transfer rules. Map the gaps against the Saudi text rather than assuming equivalence with another regime.
- An inventory of personal data processed by or for the Saudi business.
- A list of systems and service providers, with where each stores data.
- Existing privacy notices, consent forms and employee data policies.
- Group data flows that move Saudi data abroad, such as HR or CRM systems.
- A named person accountable for data protection in the Kingdom.
Stage 1: Map the processing
Record each processing activity: what data, which individuals, for what purpose, on what legal basis, who receives it, where it is stored and for how long. The PDPL and its regulations require controllers to keep records of processing that SDAIA can request.
- Deliverable: A record of processing activities for the Saudi operations.
- Owner: Data protection lead with IT and HR.
- Approval gate: Every system holding Saudi personal data is listed.
Stage 2: Confirm legal bases and notices
For each activity, identify the legal basis the PDPL recognises, such as consent, contract, legal obligation or legitimate interest where permitted, and update privacy notices so individuals are told what the law requires, in Arabic where the audience needs it.
- Deliverable: Updated notices and consent mechanisms.
- Owner: Legal with marketing and HR.
- Approval gate: No processing relies on a basis that has not been checked against the PDPL.
Stage 3: Register and appoint where required
Check whether the entity must register on SDAIA's national data governance platform and whether it must appoint a data protection officer, which depends on the nature and scale of processing as defined in the regulations.
- Deliverable: Registration confirmation and DPO appointment where applicable.
- Owner: Legal.
- Approval gate: Registration decision documented even if the answer is no.
Stage 4: Control cross-border transfers
Identify every transfer of Saudi personal data abroad, including to group systems and cloud providers. The transfer regulation permits transfers on conditions such as adequacy of the destination, appropriate safeguards like standard clauses or binding rules, or specific exceptions, and may require a risk assessment.
- Deliverable: A transfer register with the basis and safeguards for each flow.
- Owner: Data protection lead with IT.
- Approval gate: No new system storing Saudi data abroad goes live without a transfer assessment.
Stage 5: Secure and manage processors
Apply technical and organisational security measures and bind service providers by contract to process data only on instructions, keep it secure and assist with rights requests and breaches.
- Deliverable: Processor agreements and a security controls summary.
- Owner: IT and procurement.
- Approval gate: Every processor with Saudi data has a signed agreement.
Stage 6: Prepare for rights requests and breaches
Set up a process to handle requests from individuals to access, correct or delete their data within the time the regulations allow, and a breach response plan that includes notifying SDAIA and, where required, the affected individuals within the prescribed timeframe.
- Deliverable: Rights request procedure and breach response plan.
- Owner: Data protection lead.
- Approval gate: Plan tested once with a simulated incident.
Stage 7: Review and train
Train staff who handle personal data, review the records and transfer register periodically, and track SDAIA guidance, since implementing rules and guidelines continue to be issued and updated.
- Deliverable: Training records and an annual review report.
- Owner: Data protection lead.
- Approval gate: Review completed each year and after major system changes.
Handovers between stages
Most failures happen when IT introduces a new group system and nobody asks where Saudi data will be stored. Make the transfer assessment a mandatory step in IT procurement and group system rollouts, so the data protection lead sees the change before it goes live.
How you know it is finished
The programme is in place when processing is recorded, legal bases and notices are confirmed, registration and DPO decisions are documented, every transfer has a basis, processors are under contract, and breach and rights procedures have been tested. Because SDAIA continues to issue guidance, a licensed adviser should review your programme against current rules each year.
Domira works with foreign investors on the property side of entering Saudi Arabia: finding land or premises, due diligence, design, construction and asset management. For licensing, tax and legal steps, work with a licensed adviser; we coordinate with yours so the property decision fits the structure you choose.
Frequently Asked Questions
Does the Saudi PDPL apply to companies outside Saudi Arabia?
Yes, the law applies to processing carried out outside the Kingdom that relates to personal data of individuals residing in the Kingdom, as well as processing within it. A foreign company serving Saudi customers online or handling data of its Saudi subsidiary's employees may be covered. The implementing regulations define obligations such as appointing a representative in some cases, so check with an adviser.
Can personal data be transferred outside Saudi Arabia under the PDPL?
Transfers are permitted under the conditions in the PDPL and its transfer regulation, for example to countries with adequate protection, with appropriate safeguards such as standard contractual clauses or binding corporate rules, or under specific exceptions, and a risk assessment may be required. Some categories of data face stricter rules. Confirm current conditions with SDAIA guidance before moving data.
Who enforces data protection in Saudi Arabia?
The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority for the PDPL. It issues regulations and guidance, handles complaints and can impose penalties, while serious offences involving sensitive data can carry criminal consequences. Sector regulators such as SAMA may apply additional data rules for their industries.
Have a Property Question?
Domira can help you navigate property, financing and investment decisions in Saudi Arabia. Speak with our team for an initial consultation.
