Saudi PDPL compliance checklist: what businesses in the Kingdom need to know

This Saudi PDPL compliance checklist exists because the law has moved well past the point where “we have a privacy policy” counts as an answer. Saudi Arabia’s Personal Data Protection Law cleared its grace period in September 2024, and in January 2026 the Saudi Data and Artificial Intelligence Authority’s violation committees were reported to have issued 48 enforcement decisions across multiple sectors, with fines of up to SAR 5 million possible for most violations. The businesses getting caught out are rarely the ones with a genuine dispute over how they handled personal data. They are the ones missing a procedural step they did not know was mandatory.

Registration with the National Data Governance Platform

Registration is not universal, but it applies to more businesses than most assume. A data controller must register with the National Data Governance Platform (NDGP) in the cases set out in the Implementing Regulations, which include controllers whose main activity is processing personal data and controllers that process sensitive personal data. Confirm the full list of triggers against current SDAIA guidance. Private entities register through a representative appointed via the Saudi Business Center’s authorization system. There is currently no registration fee, and SDAIA notifies registered controllers 30 days before a registration certificate expires so that they can apply for renewal.

The practical mistake we see is businesses assuming registration only applies to obviously data-heavy sectors like fintech or healthcare. If sensitive data processing or large-scale personal data handling is a meaningful part of what your Saudi entity does, check this before assuming it does not apply to you.

When a Data Protection Officer is required

The PDPL does not set a simple headcount or revenue threshold for appointing a DPO. It uses a risk-based model instead. Under the Implementing Regulations, a controller must appoint a DPO where it is a public entity providing services that involve large-scale processing of personal data, where its main activities involve regular and continuous large-scale monitoring of individuals, or where its core activities involve processing sensitive personal data. The appointment must be documented, and SDAIA’s current rules should be checked for any registration or notification duty. That risk-based structure means two businesses of identical size can land on opposite sides of the requirement, depending on what they actually do with personal data rather than how many people they employ.

Cross-border data transfer requirements

This is the area generating the most enforcement activity, and it is worth treating as a distinct workstream rather than a line item inside a broader privacy policy. Transferring personal data outside Saudi Arabia requires meeting a specific set of conditions: explicit data subject consent, an adequacy assessment of the recipient country, an approved safeguard such as Standard Contractual Clauses or Binding Corporate Rules, and a mandatory risk assessment for continuous or large-scale transfers of sensitive data. Regulatory approval from SDAIA may also be required depending on the transfer mechanism used.

Get this wrong and the penalties are not abstract. Administrative violations, such as transferring data without an appropriate safeguard or skipping a required risk assessment, carry fines of up to SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation. Where a cross-border transfer is conducted illegally, the law provides for criminal penalties of up to one year’s imprisonment, a fine of up to SAR 1,000,000, or both. Intentionally disclosing or publishing sensitive personal data, with the intent to harm the individual or to gain a personal benefit, carries criminal penalties of up to two years’ imprisonment, a fine of up to SAR 3,000,000, or both, and the fine can be doubled for repeat offences. Beyond fines and imprisonment, the competent court or committee can also order publication of the judgment or decision, and courts can order confiscation of the proceeds of a violation.

The practical checklist

Reduced to the questions a business actually needs answered:

1. Registration. Is data processing your Saudi entity’s core business activity, or does it process sensitive data? If so, NDGP registration is likely mandatory, so check current SDAIA guidance for any further triggers.
2. DPO appointment. Are you a public entity processing at scale, do your main activities involve large-scale regular monitoring of individuals, or are your core activities the processing of sensitive data? If so, a DPO is required, whether hired directly or engaged as a service.
3. Cross-border transfers. Can you name, today, the legal mechanism (consent, adequacy, SCCs, BCRs) that covers every transfer of personal data your Saudi entity makes outside the Kingdom? If the honest answer is “we assume it’s fine,” that is the gap to close first.
4. Response readiness. SDAIA’s enforcement process moves quickly. A compliance programme that only exists on paper, with no one able to produce the actual records on short notice, will not hold up when a regulator asks for them.
5. Documentation. Are your consent records, data mapping, and cross-border transfer authorisations actually written down and current, or does the answer live in someone’s institutional memory? The enforcement pattern so far has skewed toward procedural failures, not disputes over the underlying handling of data.

Do this before SDAIA asks

A Saudi PDPL compliance checklist is a starting point for a conversation, not a substitute for a proper gap analysis against your actual data processing activities. If your business is expanding into Saudi Arabia, or has been operating there without a mapped PDPL programme, the fastest way to find out where you stand is to have that gap analysis done before a regulator asks the same questions on their own timeline. Get in touch for a free consultation.

Sources: Saudi Personal Data Protection Law (Royal Decree M/19, as amended); PDPL Implementing Regulations (including Article 32 on data protection officers) and SDAIA’s Rules for Appointing a Personal Data Protection Officer (August 2024); Regulation on Personal Data Transfer Outside the Kingdom (SDAIA); Clyde & Co, “Enforcement of the Saudi Personal Data Protection Law is live” (March 2026); IAPP, “Saudi Arabia’s data protection authority steps up enforcement”.

Related services

If your business handles personal data of individuals in the Kingdom, our team can help with UAE PDPL, DIFC DPL, ADGM DPR and KSA PDPL compliance, provide DPO as a Service, or run a gap analysis and remediation plan. Book a free consultation. You can also work through our UAE and Saudi PDPL readiness checklist.