Personal Data Protection Law: a practical checklist for businesses

The Personal Data Protection Law (PDPL) became fully enforceable on 14 September 2024, after a one-year grace period. It applies to any business that collects the personal data of people in the Kingdom — customers, employees or suppliers.

What you need in place

• A privacy notice: what data you collect, why, on what legal basis, and how long you keep it.
• A lawful basis for each use of the data — consent, a contract, a legal obligation or another permitted basis.
• A record of processing activities: written, kept for five years after processing ends, and available to SDAIA on request.
• Security measures proportionate to the sensitivity of the data.
• A breach procedure: serious breaches must be reported to SDAIA within 72 hours, and affected people informed where required.
• A way to handle requests from people who want to access, correct or delete their data.

When do you need a data protection officer?

When your core activities involve regular monitoring of individuals or processing sensitive data, such as health or financial data.

Sending data abroad

Transfers outside the Kingdom need safeguards — such as SDAIA's standard contractual clauses — and a risk assessment.

Penalties

Violations can bring fines of up to SAR 5 million, doubled for repeat violations.

Start with three steps

1. 1Map the personal data you hold and where it goes.
2. 2Publish a clear privacy notice on your website.
3. 3Review contracts with suppliers who process data for you (payroll, cloud, accounting systems).