Saudi Arabia. Comprehensive data protection. Regulation

PDPL Implementing RegulationsImplementing Regulation of the Personal Data Protection Law

In force

Partly verified

Medium confidence. Exact issuance date of the Implementing Regulation not re-verified; any 2024 amendment not confirmed.

§1Summary

Synopsis

Detailed rules operationalising the PDPL: lawful bases including legitimate interest, consent conditions, rights handling timelines, breach notification procedure, DPIAs, and DPO appointment criteria.

Key themes

consent
legitimate interest
DSAR timelines
breach notification
DPIA
DPO
records

Unique features

DPO mandatory for public entities doing large-scale processing, controllers whose core activity is systematic monitoring, or core processing of sensitive data; DPO details filed via the national platform.

SaaS relevance

Sets the concrete operational duties (notification, records, DPIAs) a SaaS processing Saudi data must build in.

§2Obligations

Extraterritorial: Yes
Breach notification: SDAIA within 72h
DPO: Conditional
Cross-border transfers: See Transfer Regulation
Maximum penalty: As PDPL

§3Dates

Key dates

Adopted September 2023
In force 14 September 2023
Supplemented in 2024 by SDAIA rules on DPO appointment, Controller Register and guidelines

§4Text and authority

Text

Authoritative text sdaia.gov.sa

Authority

SDAIA

§5Where it applies

Domestic law of: Saudi Arabia

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Exact issuance date of the Implementing Regulation not re-verified; any 2024 amendment not confirmed.