Saudi Arabia. Comprehensive data protection. Law (Royal Decree)
KSA PDPLPersonal Data Protection Law (Royal Decree No. M/19 of 9/2/1443H, as amended by Royal Decree No. M/148 of 5/9/1444H)
§1Summary
- Synopsis
Saudi Arabia's comprehensive data protection law, covering processing in the Kingdom and processing of residents' data from abroad, with lawful bases, rights, DPO, registration, breach notification and tight transfer rules. SDAIA is actively enforcing it.
- Key themes
- Unique features
Controllers generally must register on the National Data Governance Platform; criminal penalties for intentional disclosure of sensitive data; courts may double fines for repeat offences. Sector regulators (SAMA, CST) retain parallel rules.
- SaaS relevance
Applies to non-Saudi entities processing data of individuals residing in KSA, so foreign SaaS serving Saudi customers is in scope.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- SDAIA within 72h; data subjects without undue delay where harm likely
- DPO
- Conditional
- Cross-border transfers
- Adequate countries (SDAIA list) or appropriate safeguards (SCCs, binding common rules, accreditation) with risk assessment; limited derogations
- Maximum penalty
- SAR 5m (doubling for repeat); SAR 3m and/or 2 years' prison for sensitive-data disclosure
§3Dates
- Key dates
- Adopted
- In force
- Amended 27 Mar 2023 (M/148); in force 14 Sept 2023; one-year grace, enforceable from 14 Sept 2024
§4Text and authority
- Text
- Authoritative text laws.boe.gov.sa
- English text sdaia.gov.sa
- Authority
- Saudi Data & AI Authority (SDAIA) / National Data Management Office
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Official SDAIA PDF could not be fetched (blocked); URL from known location.