PDPL (Personal Data Protection Law)

The Personal Data Protection Law (PDPL) is Saudi Arabia's first comprehensive law governing how personal data is collected, processed, stored, disclosed, and destroyed. Fully enforced since September 2024, it applies to any organization — public or private — that processes the personal data of individuals in the Kingdom, including processing performed from outside the Kingdom. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the enforcement authority.

The law rests on principles practitioners will recognize: a lawful basis for processing with consent as the default, purpose limitation, data minimization, transparency through privacy notices, security safeguards, breach notification, and enforceable rights for data subjects such as access, correction, and destruction. Penalties can reach SAR 5 million per violation and up to SAR 10 million for repeat violations.

For a Saudi Data Management Office, the PDPL turns abstract privacy principles into an operational mandate. Compliance depends on answers only metadata can provide: which systems hold personal data, how sensitive it is, where it flows, who owns it, and on what basis it is processed. A maintained data catalog with classification, lineage, and ownership is therefore the practical foundation for every PDPL obligation — from responding to a data subject request within the required timeframe to scoping a breach notification accurately.