PDPL vs. CCPA: what US general counsel get wrong

PDPL vs CCPA is a comparison most US legal teams get wrong before they even realize they are making it.

“We’re already CCPA compliant, so Saudi should be straightforward.” This is the single most common assumption we hear from US legal teams before their first Saudi Arabia engagement, and it is wrong in ways that create real exposure, not just extra paperwork.

Opt-out versus opt-in is the whole ballgame

CCPA and its successor CPRA are built on an opt-out model. A business can collect and use personal data by default, and the consumer’s right is to say no, typically through a “Do Not Sell or Share My Personal Information” mechanism. Saudi Arabia’s PDPL runs the other way: consent is a central lawful basis and, where it is relied on, must be obtained before processing begins, not after, with only limited alternative grounds available. A US company that has spent years building a CCPA-compliant opt-out flow does not have a PDPL-compliant consent flow. It has a different product that happens to look similar.

The penalty structure is not just “bigger fines”

US privacy counsel are used to thinking about penalties as a civil, financial question: what is the fine, and how does it compare to the cost of compliance. PDPL adds a dimension most US privacy programs have never had to plan for. Administrative fines run up to SAR 5 million (roughly $1.3 million), doubled for repeat violations, but specific violations, including unauthorized cross-border transfer, carry criminal exposure as well: imprisonment of up to a year (and/or a fine) for unauthorized cross-border transfer, and up to two years (and/or a fine) for intentionally disclosing or publishing sensitive personal data with the intent to harm the individual or to gain a personal benefit. That is not a number on a risk register. It is a reason the person signing off on your Saudi data architecture needs to understand it personally, not delegate it to a vendor.

Extraterritorial scope works differently

CCPA applies based on a business’s revenue, data volume, and California nexus. PDPL’s scope is anchored to where the data subject is, not where your company is incorporated or headquartered. A US company with no Saudi office, no Saudi employees, and no Saudi bank account can still be squarely inside PDPL’s scope the moment it processes personal data of individuals inside Saudi Arabia, including through a website, an app, or a vendor relationship. “We’re not registered there” is not a defense US GCs can rely on the way they might assume.

Cross-border transfer has no CCPA equivalent at all

This is the gap that catches the most experienced US privacy teams off guard, because CCPA simply does not have a cross-border transfer regime to compare it to. Moving data out of California to a US data center is a non-event under CCPA. Moving data out of Saudi Arabia requires the transfer to meet specific conditions set by the law and its regulations, such as an adequate level of protection at the destination or appropriate safeguards, before the transfer happens, not as a post-hoc justification if it is ever questioned.

What “PDPL compliant” actually requires

Being PDPL compliant is not a documentation exercise layered on top of an existing US privacy program. It requires, at minimum: a lawful basis and consent mechanism built for an opt-in default, a data flow map that identifies every cross-border transfer and its legal basis, a localization check against any sector-specific rule that applies to your industry, and a governance structure with someone accountable for Saudi-specific decisions, not a US privacy officer applying US instincts to Saudi facts.

None of this means US companies should avoid the Saudi or UAE market, and none of it is a reason to build a second in-house privacy function from scratch. It is a reason to bring in Gulf-region expertise for the pieces your existing program was never built to cover.

dataTRUST advises US companies on exactly this gap, translating PDPL, DIFC DPL and ADGM DPR requirements into terms a US legal team can act on. Book a free consultation to map where your current program actually falls short.

Sources: Saudi Personal Data Protection Law and SDAIA guidance; California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) as enacted; SDAIA enforcement committee reporting, January 2026.

Related services

Operating across the US and the Gulf means juggling several regimes at once. We advise on UAE PDPL, DIFC DPL, ADGM DPR and KSA PDPL compliance, general data privacy consulting, and data protection audits. Talk to our team.