Fully enforceable since September 14, 2024, the Personal Data Protection Law (PDPL) was originally issued by Royal Decree No. M/19 of 2021, and the later amended, Royal Decree No. M/148 of 2023; was introduced as Saudi Arabia’s first comprehensive federal data protection framework. It’s a significant step for Saudi Arabia towards securing personal information, building public trust, and aligning with international data privacy standards.

What is the Saudi PDPL?

The PDPL establishes a set rule for the collection, processing, storage, and transfer of personal data within the Saudi Arabia. Its main goal is to protect individuals’ privacy while requiring organizations to handle data responsibly and transparently.

Heavily inspired by global models like the EU’s GDPR, the PDPL reflects Saudi Arabia’s ambition to be a leader in the digital economy by promoting accountability and secure data practices.

Who Does the PDPL Apply To?

The PDPL has a wide scope, applies to:

• Any entity (public or private) located in Saudi Arabia that processes personal data.
• Any entity located outside Saudi Arabia that processes personal data related to individuals residing in Saudi Arabia.

This means even international businesses interacting with Saudi residents’ data need to comply with the PDPL.

Important Exemptions:

While comprehensive, the PDPL does include certain exemptions, such as personal data processed for purely personal or household purposes. It’s crucial for organizations to consult the law and its implementing regulations for a precise understanding of applicable exemptions.

Key Principles of Data Processing under PDPL:

The PDPL outlines six core principles that shape how data must be managed:

1. Lawfulness, Fairness, and Transparency: Data must be processed legally, fairly, and in a clear, open manner.
2. Purpose Limitation: Collect data only for specific, legitimate purposes and avoid using it for unrelated reasons.
3. Data Minimization: Gather only the data that’s necessary and relevant for the intended purpose.
4. Accuracy: Ensure personal data is correct and kept up to date.
5. Storage Limitation: Don’t retain data longer than needed for its original purpose.
6. Security and Confidentiality: Protect data with appropriate technical and organizational safeguards against unauthorized access, loss, or misuse

Read Full Blog Here — Saudi Arabia’s PDPL: A New Era for Data Privacy in the Kingdom