Saudi Arabia's Personal Data Protection Law (PDPL) issued by SDAIA/NDMO — requirements, rights, and compliance obligations for organisations processing personal data in the Kingdom.
Ask GCC LexAI about Data Protection →The Personal Data Protection Law (PDPL) was issued by Royal Decree in September 2021 and is enforced by the National Data Management Office (NDMO) under SDAIA. It regulates collection, processing, and transfer of personal data.
The PDPL came into force in March 2022, with a transition period. Full enforcement and penalties began applying to organisations that failed to comply.
Key requirements include obtaining explicit consent for data processing, appointing a Data Protection Officer, implementing technical and organisational security measures, notifying NDMO of data breaches, and restricting cross-border data transfers.