Act 2021
Personal Data Protection Law (PDPL)
Nizam Himayat Al-Bayanat Al-Shakhsiyah
Issued by Saudi Data and AI Authority
Effective: 16 Sep 2021
Last amended: 27 Mar 2023
Plain-English summary
The Saudi Arabia Personal Data Protection Law (PDPL) is the leading legislation of its kind in the Kingdom of Saudi Arabia that addresses the processing and management of personal data by both private and public entities. Passed into law under the Royal Decree No. M/19, the law brings the Kingdom in line with international standards on privacy, like GDPR, through Saudi Vision 2030. Regulated and enforced by the Saudi Data and AI Authority (SDAIA), the PDPL is an extraterritorial legislation that covers any organization around the world that processes the data of people who reside in the Kingdom of Saudi Arabia. Under the law, the residents of the Kingdom have a right to access, modify, or destroy their data, while the enterprises in the Kingdom must obtain consent of the data subjects, restrict data collection, report a breach within 72 hours, and conduct a thorough risk assessment for any transfer of data outside the Kingdom. Failure to comply with the framework attracts an administrative fine of up to SAR 5,000,000 and a jail term of up to two years for any unauthorized release of sensitive data.
Who it applies to
Banking · Telecom & Tech · Healthcare & Pharma
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | Ongoing | SDAIA | official | |
The Saudi Personal Data Protection Law (PDPL), which was introduced through Royal Decree No. M/19 and is regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA), is an extensive legislative system for the control of personal data processing in the country. The organization has to ground each of its data processing procedures on one of the six possible legal bases for data processing, such as explicit consent, contractual necessity, or legal obligation, while excluding the processing of sensitive data on the grounds of legitimate interest. At the same time, before the data collection process, the organization has to provide a Privacy Notice informing about the purpose of the data processing, its minimization, retention period, and disclosure to third parties. Moreover, Saudi citizens have been granted significant and mandatory Data Subject Rights, such as the right to information, access, rectification, portability, erasure, and consent withdrawal, to be fulfilled within 30 days of the request being filed to avoid substantial administrative fines. |
||||
| Personal data breach notification | Deadline Event-based | SDAIA | official | |
Saudi Arabia’s Personal Data Breach Notification Requirements under the Personal Data Protection Law (PDPL), which is implemented by SDAIA, impose a mandatory requirement for the data controller to notify the authority regarding any personal data breach within 72 hours since becoming aware of it. There is no minimum limit imposed for the data breach notification requirement, which must be provided via electronic means on the National Data Governance Platform and should contain a technical description of the data breach, amount of data breached, associated risks, and any action taken in relation to the incident. Moreover, if the data breach causes a risk of harm or financial loss for the individual concerned, then the organization shall notify the individuals in question immediately in a plain language manner. Not adhering to such reporting periods, along with the breach logbook, makes organizations vulnerable to sanctions ranging from administrative fines of SAR 5 million and operational suspension. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.