Data protection & privacy laws in Saudi Arabia (2026)

SDAIA's quasi-judicial enforcement committees began issuing binding decisions including warnings, fines up to SAR 5 million, and remediation orders against non-compliant organisations. Signals the definitive end of the post-enactment tolerance period.

SDAIA's specialised committees announced 48 adjudication decisions against organisations for PDPL violations covering unlawful data collection, inadequate security controls, and unsolicited marketing without prior consent — establishing enforcement precedents across retail, telecoms, and financial services.

The transition period ended, making all PDPL obligations — including breach notification, data-subject rights, and consent requirements — immediately and fully enforceable against all public and private entities processing personal data in the Kingdom.

SDAIA published a standalone regulation governing personal data transfers outside Saudi Arabia, requiring either an SDAIA adequacy determination for the destination country or explicit SDAIA authorisation, and mandating risk assessments for large-scale or continuous cross-border transfers.

The NCA released a revised ECC framework that removed the explicit data-localisation requirement from its own controls — transferring data-residency governance to NDMO/SDAIA — while strengthening incident-response, supply-chain, and cloud-security requirements.

Saudi Arabia's first comprehensive data protection law took effect alongside its implementing regulations; a one-year grace period until 14 September 2024 was granted for full compliance while SDAIA activated its supervisory powers and breach-notification registry.

One week before enforcement, SDAIA issued detailed rules setting a 72-hour breach notification window, 30-day data-subject request deadlines, requirements for data-protection impact assessments (DPIAs), and a preliminary cross-border data transfer framework.

The Council of Ministers approved 27 amendments that narrowed the sensitive-data definition, replaced 'written consent' with 'clear consent', expanded legitimate-interest processing grounds, and granted SDAIA investigators explicit confiscation powers, while confirming the September 2023 enforcement date.

A Royal Decree created the Saudi Data & Artificial Intelligence Authority (SDAIA) together with the National Data Management Office (NDMO) and National Centre for AI (NCAI), making SDAIA the de facto data governance regulator and the body that would later administer the PDPL.

The NCA's first ECC standard required government entities to host and store data on servers physically within Saudi Arabia, establishing the Kingdom's first statutory data-localisation requirement and setting mandatory baseline data-handling security controls.

King Salman issued Royal Order No. 6801 creating the NCA, directly linked to the Royal Court, with a mandate to protect critical infrastructure and government data. The NCA became the primary regulator for cybersecurity and data-handling standards until SDAIA's creation in 2019.

Saudi Arabia's first law addressing digital privacy, criminalising unauthorised computer access, interception of personal data, and misuse of information networks; carried penalties up to one year imprisonment and SAR 500,000 in fines. Served as the primary pre-PDPL privacy framework for 15 years.