Saudi Personal Data Protection Law (PDPL): Key Facts

Last reviewed: July 2026

The Personal Data Protection Law (PDPL) is Saudi Arabia's comprehensive data protection framework. It applies to every organization, inside or outside the Kingdom, that processes the personal data of individuals in Saudi Arabia. The grace period ended on 14 September 2024. The PDPL is now in full, active enforcement.

Frequently Asked Questions

Assess Your PDPL Readiness

Most organizations discover their compliance gaps during a regulator inquiry or a data subject complaint. The better time is now.

Take the PDPL Self Assessment Join a PDPL Masterclass Start a Co-Pilot free trial

Saudi Personal Data Protection Law (PDPL): Key Facts

What Is the PDPL?

Who Must Comply

Data Protection Program Requirements

Individual Rights & Response Deadlines

Enforcement & Penalties

Frequently Asked Questions

Assess Your PDPL Readiness

Saudi Personal Data Protection Law (PDPL): Key Facts

What Is the PDPL?Legal foundation and current status

What Is the PDPL?

Who Must ComplyScope and extraterritorial reach

Who Must Comply

Data Protection Program RequirementsWhat a compliant program must include

Data Protection Program Requirements

Individual Rights & Response DeadlinesData subject rights and organizational response requirements

Individual Rights & Response Deadlines

Enforcement & PenaltiesActive regulator, real decisions

Enforcement & Penalties

Frequently Asked Questions

Does the PDPL apply to companies outside Saudi Arabia?

When did PDPL enforcement begin?

What are the maximum PDPL fines?

Do I need to appoint a DPO?

How quickly must I report a data breach?

Can I store Saudi personal data outside the Kingdom?

Is GDPR compliance enough for the PDPL?

Assess Your PDPL Readiness