Is your company compliant with Saudi Arabia's Personal Data Protection Law?

Your customers' and employees' data is a trust… and the law holds you accountable for it.

Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since September 2024. Fines reach SAR 5 million per violation and can be doubled for repeat offences.

It is no longer theoretical

In June 2026, SDAIA's review committees issued fines and warnings against entities that violated the law. The violations included:

• Direct marketing without the data subject's explicit consent.
• Not responding to data subjects' requests in time.
• Not notifying SDAIA of a personal data breach within 72 hours.
• Not taking the measures needed to protect personal data.
• Not appointing a data protection officer when the conditions required one.

Is your company safe from these violations?

How we help

1. Gap assessment: we compare where you are today with the law and its regulations, and set priorities.
2. Record of processing activities: we map your data, its sources, where it is stored and why it is processed.
3. Policies and notices: we prepare your privacy policy, notices and consent forms.
4. Incident response: a plan to detect a breach and report it within 72 hours.
5. Suppliers and contracts: data protection clauses in third-party contracts.
6. Data protection officer: we determine when you need one and support the role.
7. Training and awareness: for your team, so compliance becomes everyday practice.

Because compliance is ongoing, not a one-off project, we stay with you through periodic reviews that keep your company compliant as the law and its regulations evolve.

Book a free initial assessment session to review where your company stands and set its priorities.

Book your session

Sources: The law · SDAIA · SDAIA decisions · Okaz