( Guide · Compliance · Saudi Arabia )
Saudi PDPL compliance for websites and apps: what SDAIA's rules require in 2026
By OGB Labs · Published
The law, the regulator and the dates
The PDPL and its rules are published on SDAIA's National Data Governance Platform, which hosts the law, the Implementing Regulation, the Regulation on Personal Data Transfer Outside the Kingdom, the standard contractual clauses, and guidelines including one on preparing a privacy policy. The law came into force on 14 September 2023 with a one-year grace period, so it has been enforceable since 14 September 2024.
Enforcement is active. Committees appointed by SDAIA review violations and can issue warnings and fines, and law firm commentary such as Clyde & Co's March 2026 note reports that SDAIA announced 48 decisions for 2025, covering processing without a legal basis, unlawful disclosure, weak security and marketing messages sent without consent. Those are exactly the failures a typical website or app is exposed to.
Does the PDPL apply to your website or app?
- Yes, if it collects personal data of people in Saudi Arabia: contact and enquiry forms, accounts and logins, checkout and delivery details, newsletters, WhatsApp chat histories, job applications, location, and analytics that identify a person.
- It applies whether your company is in the Kingdom or abroad. SDAIA's registration portal has a route for entities outside the Kingdom, and in October 2026 Clyde & Co reported that SDAIA had opened controller registration to overseas organisations.
- You are the controller when you decide why and how data is processed. Your developer, hosting provider, CRM and email platform are usually processors, and the law expects you to choose processors that protect the data and to bind them by contract.
- Sensitive data needs extra care. The law's definition includes health, genetic and biometric data, religious and political beliefs, and criminal and security data. Clinics, schools, HR systems and apps with face or fingerprint login fall here.
What your website or app must do
| Requirement | Where it comes from | What it means in practice |
|---|---|---|
| Privacy policy | Law Art. 12 | A policy available when data is collected, stating the purpose, the data collected, how it is collected and stored, and how people can use their rights. Link it from every form and the app's sign-up screen. |
| Legal basis and consent | Law Arts. 5, 6 | Consent unless an exception applies, such as performing a contract. Consent can be withdrawn at any time, so build a way to do it. |
| Collect the minimum | Law and SDAIA's minimum data guideline | Remove fields you do not use. A quote form rarely needs a national ID or date of birth. |
| Data subject rights | Law Art. 4; Reg. Art. 3 | Access, a copy, correction and deletion. Reply within 30 days, extendable by up to 30 more with notice and reasons. |
| Marketing messages | Law Art. 25; Reg. Arts. 28, 29 | Consent before sending promotional messages to someone without a prior relationship, the sender clearly named, and an easy, free opt-out. Stop when consent is withdrawn. |
| Security | Law and Implementing Regulation | HTTPS everywhere, access control, encryption of sensitive data, patched software, logging and tested backups. |
| Breach notification | Law Art. 20; Reg. Art. 24 | Notify SDAIA within 72 hours of becoming aware of a breach that could harm people, and tell affected people without undue delay where they could be harmed. |
| Impact assessment | Reg. Art. 25 | A written assessment before processing sensitive data or linking datasets from different sources. |
| Records of processing | Reg. Art. 33 | A written, up-to-date record of purposes, data, recipients, transfers and security, kept for the processing period plus five years. |
| Data Protection Officer | Reg. Art. 32 | Required where core activities involve regular and systematic monitoring of people or processing sensitive data, and for public bodies with large-scale processing. SDAIA's portal has a tool to check. |
| Transfers abroad | Law Art. 29 and the transfer regulation | Hosting, analytics, email or AI tools outside the Kingdom need a lawful transfer route, such as an adequacy decision or SDAIA's standard contractual clauses, and a risk assessment in some cases. |
Consent, cookies and marketing on your site
The PDPL text does not contain a cookie rule by name, but analytics and advertising tags that identify visitors are personal data processing, so they need a legal basis and must be described in the privacy policy. The safe pattern for Saudi sites is the same one we use across the Gulf: load only strictly necessary cookies by default, and load analytics, advertising pixels and session recording only after the visitor agrees, with a banner in Arabic and English that offers accept and reject equally.
Marketing is where SDAIA has already found violations. Do not pre-tick newsletter or WhatsApp marketing boxes, keep a record of when and how each person agreed, name your business in every message, and include an unsubscribe link or a reply-to-stop option that works. Customer service messages about an order are not marketing; promotions are.
Hosting, data transfers and the proposed storage rule
Many Saudi websites run on cloud regions, email platforms and analytics outside the Kingdom. Today that is allowed when the transfer meets Article 29 and the transfer regulation: the data transferred is limited to what is needed, the transfer does not harm national security or the Kingdom's vital interests, and the recipient offers adequate protection, for example through SDAIA's standard contractual clauses. Keep a list of every service that receives personal data and where it stores it.
That may change. In the draft amendments to the Implementing Regulation that SDAIA put to public consultation from 6 October to 5 November 2026, a new article would require controllers to store personal data inside the Kingdom, while still allowing transfers under the law, according to Clyde & Co's summary of the draft. If adopted, the amendments would apply 60 days after publication in the Official Gazette. If you are choosing hosting for a new Saudi system now, a Saudi cloud region for the main database is the option least likely to need rework. Our guide to Saudi data residency and cloud hosting covers who must host in the Kingdom and which cloud regions exist.
SDAIA's October 2026 draft amendments: what may change
These are proposals under consultation, not final rules. As summarised by Clyde & Co, the draft would:
- Require personal data to be stored inside the Kingdom, with transfers still possible under the law.
- Require breach notification to SDAIA within 72 hours for any breach, removing the current harm threshold.
- Extend impact assessments to processing about minors, large-scale or systematic monitoring, emerging technologies and automated decisions.
- Make registration in the National Register of Controllers mandatory for public entities, controllers whose core activities are data processing, those processing sensitive data, and those transferring data abroad.
- Give organisations 20 business days to answer SDAIA's requests, and treat an unanswered data subject request as rejected after 30 days, opening a complaint to SDAIA.
- Tighten marketing: verified and recorded consent, clear withdrawal, and deletion of marketing data when consent is withdrawn.
- Require privacy policies in clear, simple language that the audience customarily uses, which in practice means Arabic for Saudi users.
A compliance checklist for your website or app
Map the data
List every form, account field, payment step, chat, analytics tag and third-party service, what personal data each collects, why, and where it is stored.
Remove fields you do not need, and mark which purpose and legal basis each remaining field serves.
Write the privacy policy in Arabic and English using SDAIA's privacy policy guideline, and link it at every point of collection.
Add a consent banner that blocks non-essential tags until the visitor agrees, and unticked, recorded consent for marketing.
Build a way to handle rights requests
An email or form, identity checks, and a 30-day tracker.
Secure the stack
HTTPS, role-based admin access with two-factor login, encryption of sensitive fields, updates, logging and tested backups.
Write a breach plan
Who decides, how to notify SDAIA through its platform within 72 hours, and how to tell affected people.
Review transfers
For each service outside the Kingdom, record the transfer route, and use SDAIA's standard contractual clauses where needed.
Check whether you must register as a controller or appoint a DPO, using the tools on SDAIA's platform.
Keep the record of processing and review it whenever you add a feature, a form or a vendor.
Selling in both Saudi Arabia and Oman
Oman has its own Personal Data Protection Law, supervised by the Ministry of Transport, Communications and Information Technology, with different permits, deadlines and transfer rules. A site serving both markets can use one privacy framework, but should meet the stricter rule on each point and name both laws. See our guide to Oman PDPL compliance for websites and apps.
If the site is a store, the Saudi E-Commerce Law adds its own data rule: Article 5 limits how long you keep customer data and bans onward disclosure without consent. Our guide to Saudi E-Commerce Law requirements for online stores covers it with the disclosure, return and delivery duties.
How OGB Labs helps
On Saudi projects we build the PDPL controls into the product rather than adding them at the end: data mapping in discovery, minimal forms, Arabic-first privacy pages, consent management that actually blocks tags, rights-request handling, audit logging, encryption, and hosting in a Saudi region when the data calls for it. We work alongside your legal adviser on the policy text. See web development in Saudi Arabia, our website design and development and mobile app services, and our guides to payment gateways in Saudi Arabia and ZATCA e-invoicing Phase 2, or message us on WhatsApp at +968 7111 0727.
( FAQ )
Questions people ask.
Is the Saudi PDPL in force?
Yes. It came into force on 14 September 2023 with a one-year grace period and has been fully enforceable since 14 September 2024. SDAIA's committees issued enforcement decisions during 2025.
Who enforces data protection in Saudi Arabia?
The Saudi Data and AI Authority (SDAIA). It publishes the law, regulations and guidelines on its National Data Governance Platform, runs the National Register of Controllers, and receives breach notifications.
What are the penalties under the Saudi PDPL?
For most violations, a warning or a fine of up to SAR 5 million, which can be doubled for repeat violations. Unlawfully disclosing or publishing sensitive data with intent to harm or for personal gain can bring up to two years in prison and a fine of up to SAR 3 million.
Does my website need a privacy policy in Saudi Arabia?
Yes. Article 12 of the PDPL requires a privacy policy available to people when their data is collected. SDAIA publishes a guideline on preparing one, and its 2026 draft amendments would require it in the language your audience uses, in practice Arabic.
How fast must a data breach be reported in Saudi Arabia?
Within 72 hours of becoming aware of it, to SDAIA, where the breach could harm personal data or people's rights. Affected people must be told without undue delay where they could be harmed. A 2026 draft would remove the harm threshold for notifying SDAIA.
Can I host a Saudi website outside Saudi Arabia?
Currently yes, if transfers meet Article 29 of the PDPL and the transfer regulation, for example using SDAIA's standard contractual clauses. SDAIA's October 2026 draft would add a requirement to store personal data in the Kingdom, so new systems should consider a Saudi cloud region.
Does the PDPL apply to companies outside Saudi Arabia?
It applies to processing personal data of people in the Kingdom, and SDAIA's portal offers controller registration for entities outside the Kingdom. If you sell to Saudi customers from abroad, plan to comply.
Do I need consent to send marketing emails or WhatsApp messages in Saudi Arabia?
Yes, in general. Promotional messages to people without a prior relationship need consent, the sender must be clearly named, and people must be able to opt out easily and for free. SDAIA has already penalised marketing sent without consent.
Do I need a Data Protection Officer?
Only in certain cases: where your core activities involve regular and systematic monitoring of people or processing sensitive data, or for public bodies processing at large scale. SDAIA's platform has a tool to check.
( Related )
Service · 01
Websites
Company websites and web platforms designed around your brand, built to rank and to turn visitors into customers.
Service · 03
Mobile Apps
iOS and Android apps people open every day — designed, engineered and shipped to the stores.
Guide · AI search · Marketing
Get recommended by ChatGPT, Perplexity and Google AI
Guide · Analytics · AI search
Measure AI search traffic in GA4 and Search Console
Guide · Ecommerce · Saudi Arabia
Saudi VAT registration for online sellers
( Next step )
Want this done for you?
Tell us what you are building. We reply within one business day.