Personal data in Saudi Arabia: what the PDPL asks of organisations

The Saudi Personal Data Protection Law (PDPL), as amended by Royal Decree No. M/148 dated 5/9/1444H, came into force on 29/2/1445H — 14 September 2023.1 The Saudi Central Bank reminded the entities it supervises to comply with the amended law and its implementing regulations.1

Three obligations that shape a compliance programme

• Breach notification. The controller must notify the competent authority on becoming aware of a leak, damage or unlawful access to personal data, and notify the data subject where it may harm their data or conflict with their rights or interests (Article 20).2
• Transfers outside the Kingdom. Transfers are permitted only for defined purposes and subject to conditions, including an adequate level of protection and limiting the data to the minimum necessary (Article 29).2 A dedicated regulation sets out how adequacy is assessed and which safeguards — such as standard contractual clauses or binding corporate rules — can be used where adequacy is absent, together with risk assessment.3
• Data protection officer. The regulations determine the cases in which a controller must appoint one or more persons responsible for compliance (Article 30).2

A sensible order of work

1. Map what personal data you hold, why, where it is stored and who receives it.
2. Check which transfers leave the Kingdom and on which basis.
3. Prepare an incident-response procedure with notification roles.
4. Update privacy notices, processor contracts and retention rules.
5. Decide whether you must appoint a data protection officer.

Applicability depends on what you process and how; a programme should follow an assessment, not precede it.

This note is general information, not legal advice. Check the text in force with the competent authority before acting.