Data Protection Update in Saudi Arabia: Q4 2025

Saudi Arabia';s data protection framework entered a more demanding phase in Q4 2025. The Saudi Data and Artificial Intelligence Authority (SDAIA) issued fresh implementing regulations and enforcement guidance under the Personal Data Protection Law (PDPL), tightening obligations for both local entities and foreign businesses processing Saudi residents'; data. For international companies, the practical stakes are higher than ever: non-compliance now carries meaningful financial penalties and reputational exposure. This guide covers the key regulatory developments, enforcement trends, cross-border transfer rules, sector-specific updates, and the practical steps businesses should take in response.

The PDPL, which entered into force in its amended form in the recent regulatory cycle, continued to evolve through Q4 2025 as SDAIA published additional implementing regulations and clarifications. The most significant development was the issuance of updated regulations governing sensitive personal data and the conditions under which it may be processed. These regulations narrowed the permissible bases for processing health, biometric, and financial data, requiring organisations to obtain explicit, documented consent in most cases rather than relying on legitimate interest grounds.

SDAIA also published revised guidance on the appointment of Data Protection Officers (DPOs). Under the updated framework, entities that process personal data at scale - including e-commerce platforms, financial institutions, and healthcare providers - are required to designate a DPO and register that appointment with SDAIA through its official portal. The DPO must have demonstrable expertise in data protection law and practice, and the role cannot be held by someone with a conflicting operational responsibility such as a chief information officer who also controls data processing decisions.

A further development was the publication of a model privacy notice template by SDAIA. While use of the template is not mandatory, regulators have indicated that notices deviating significantly from the prescribed structure will receive closer scrutiny during audits. In practice, many businesses operating in Saudi Arabia are treating the template as a de facto standard to reduce regulatory risk.

The National Cybersecurity Authority (NCA) also issued updated Essential Cybersecurity Controls in Q4 2025, which intersect with PDPL obligations. Organisations subject to both frameworks - particularly those in critical infrastructure sectors - must now demonstrate alignment between their cybersecurity posture and their data protection practices, creating an integrated compliance obligation that many businesses had not previously anticipated.

SDAIA';s enforcement activity increased noticeably during Q4 2025. The authority completed several formal investigations and issued penalty decisions against entities in the retail, telecommunications, and financial services sectors. While the specific identities of sanctioned entities were not publicly disclosed in all cases, SDAIA published summary enforcement reports that revealed the categories of violation most commonly identified.

The most frequently cited violations included failure to implement adequate technical and organisational security measures, unlawful cross-border transfer of personal data without satisfying the conditions set out in the PDPL';s transfer provisions, and failure to respond to data subject requests within the statutory timeframe. Under the PDPL, data subjects have the right to access, correct, and request deletion of their personal data, and controllers must respond within defined periods. Enforcement findings indicated that many organisations had not operationalised these rights in a way that allowed timely responses, particularly where data was held across multiple systems or third-party processors.

Penalties under the PDPL are tiered. Violations involving sensitive personal data or intentional breaches attract higher financial penalties, while procedural failures such as inadequate record-keeping attract lower-level sanctions. SDAIA';s Q4 enforcement signals suggest the authority is moving from a primarily advisory posture to active enforcement, and businesses should treat any outstanding compliance gaps as urgent.

A common mistake among foreign-headquartered businesses is assuming that SDAIA';s enforcement reach is limited to Saudi-incorporated entities. The PDPL applies to any processing of personal data relating to individuals in Saudi Arabia, regardless of where the controller is established. This extraterritorial scope means that a European or Asian company running a Saudi-facing website or app is within SDAIA';s jurisdiction.

Cross-border data transfers remain one of the most operationally complex areas of saudi arabia data protection 2025 compliance. The PDPL permits transfers of personal data outside Saudi Arabia only where specific conditions are met. In Q4 2025, SDAIA issued clarifying guidance that addressed several ambiguities in the original transfer provisions.

The primary permitted grounds for transfer are: the transfer is necessary for the performance of a contract to which the data subject is a party; the data subject has given explicit consent after being informed of the destination country and the risks involved; or the transfer is to a country that SDAIA has determined provides an adequate level of protection. SDAIA has not yet published a formal adequacy list equivalent to those maintained by other major data protection authorities, but the Q4 guidance indicated that a list is under development and that transfers to jurisdictions with comprehensive data protection laws will be treated more favourably pending its publication.

For transfers that do not fall within a permitted ground, organisations must implement contractual safeguards. SDAIA';s Q4 guidance endorsed the use of standard contractual clauses (SCCs) modelled on internationally recognised frameworks, adapted to reflect Saudi law requirements. Businesses relying on SCCs must ensure that the clauses are actually incorporated into their data processing agreements and that the receiving party';s data protection practices have been assessed before the transfer takes place.

A non-obvious requirement that surfaced in Q4 guidance is the obligation to maintain a transfer impact assessment for high-risk transfers. This assessment must evaluate the legal framework of the destination country, the nature of the data being transferred, and the likelihood that the receiving party will be subject to government access requests that could undermine the protections afforded by the SCCs. Many organisations have not yet built this assessment into their transfer governance processes.

In practice, founders and compliance teams should consider mapping all data flows that cross Saudi borders before implementing any transfer mechanism. A common mistake is to execute SCCs without first identifying which data flows they are intended to cover, resulting in gaps where transfers occur outside any contractual framework.

If your organisation is navigating cross-border transfer compliance or needs to assess whether your current data processing agreements meet SDAIA';s updated requirements, contact info@vlolawfirm.com. We can assist with documents and filings.

Several sectors experienced targeted regulatory activity in Q4 2025 that goes beyond the general PDPL framework.

In healthcare, the Ministry of Health issued supplementary guidance on the processing of patient data in digital health applications. The guidance requires health app operators to obtain separate, granular consent for each category of health data collected, and prohibits the use of health data for advertising or profiling purposes even where the data subject has consented to the app';s general terms. Operators of telemedicine platforms and health monitoring applications should review their consent flows and data use policies against this guidance as a priority.

In the fintech sector, the Saudi Central Bank (SAMA) updated its Open Banking Framework to incorporate enhanced data sharing consent requirements. Under the revised framework, payment service providers and account information service providers must implement a standardised consent dashboard that allows customers to view, manage, and revoke data sharing permissions in real time. The technical specifications for the consent dashboard were published in Q4 2025, and providers are expected to implement them within the compliance window set by SAMA. Failure to do so will constitute a breach of both the Open Banking Framework and, where personal data is involved, the PDPL.

In e-commerce, SDAIA and the Ministry of Commerce issued a joint circular addressing the use of tracking technologies, including cookies and device fingerprinting, on Saudi-facing websites and applications. The circular requires operators to obtain prior consent before deploying non-essential tracking technologies and to provide a mechanism for users to withdraw consent as easily as it was given. Many e-commerce operators currently rely on implied consent or pre-ticked boxes, which the circular explicitly states are insufficient. Businesses should audit their cookie consent mechanisms and update them to meet the explicit consent standard.

A practical scenario: a regional e-commerce platform operating across the Gulf Cooperation Council may have implemented a single cookie consent banner for all markets. That banner may satisfy requirements in some jurisdictions but fall short of the Saudi standard if it does not offer granular category-level consent and a withdrawal mechanism. Updating the banner for the Saudi market specifically is a concrete, near-term action.

A second scenario: a fintech startup offering a payment aggregation service may have assumed that its existing privacy policy, drafted to comply with European standards, is sufficient for Saudi operations. In practice, the PDPL requires specific disclosures tailored to Saudi law, including information about the data subject';s rights under Saudi legislation and the identity of the local DPO. A European-standard policy will not satisfy these requirements without adaptation.

The Q4 2025 developments collectively require businesses to revisit several core compliance processes. The following areas warrant immediate attention.

Data mapping and records of processing: SDAIA';s enforcement findings indicate that many organisations lack an accurate, up-to-date record of the personal data they process, the purposes for which it is processed, and the third parties with whom it is shared. The PDPL requires controllers to maintain such records, and SDAIA has indicated that an inability to produce them during an audit will be treated as an aggravating factor in any penalty assessment.

Consent management: the updated guidance on sensitive data and tracking technologies means that many existing consent mechanisms are no longer compliant. Businesses should conduct a consent audit, identifying every point at which personal data is collected and verifying that the consent obtained meets the current standard - explicit, informed, specific, and freely given.

Data subject rights procedures: organisations must have documented procedures for handling access, correction, and deletion requests. These procedures should specify who is responsible for receiving and processing requests, what verification steps are required, and how responses will be delivered within the statutory timeframe. Many organisations have policies on paper but no operational workflow to support them.

Vendor and processor management: the PDPL requires controllers to ensure that processors acting on their behalf provide sufficient guarantees of compliance. This means reviewing data processing agreements with all third-party vendors, cloud providers, and service partners to confirm that appropriate contractual protections are in place and that the vendor';s security practices have been assessed.

Incident response and breach notification: the PDPL requires notification to SDAIA in the event of a personal data breach that is likely to cause harm to data subjects. The notification must be made within a defined period and must include specified information about the nature of the breach, the data affected, and the remedial steps taken. Businesses should ensure their incident response plans address the Saudi notification requirement specifically, as the timeframe and content requirements differ from those in other jurisdictions.

Many underestimate the operational complexity of running parallel compliance programmes for multiple jurisdictions. Saudi Arabia';s requirements are substantive and distinct, and a copy-paste approach from a European or US compliance programme will leave material gaps.

What are the most significant practical risks for foreign businesses processing Saudi residents'; data?

The primary risks are financial penalties for unlawful processing or transfer of personal data, regulatory investigations triggered by data subject complaints, and reputational damage from public enforcement reports. SDAIA';s extraterritorial jurisdiction means that a foreign company does not need a physical presence in Saudi Arabia to be subject to the PDPL - processing data relating to Saudi residents is sufficient. Foreign businesses that have not appointed a local DPO, adapted their privacy notices to Saudi requirements, or implemented compliant transfer mechanisms are particularly exposed. The Q4 2025 enforcement trend suggests that SDAIA is actively pursuing cases beyond the domestic market, making this a live risk rather than a theoretical one.

How long does it take to achieve PDPL compliance, and what does it typically cost?

The timeline depends heavily on the size and complexity of the organisation and the maturity of its existing data protection programme. A small business with limited data processing activities might achieve baseline compliance within a few weeks if it moves quickly. A larger organisation with complex data flows, multiple processors, and cross-border transfers should budget several months for a thorough compliance programme. Professional fees for legal and technical advisory support typically start from the low thousands of USD for scoped engagements and rise significantly for enterprise-level programmes. State registration fees for DPO appointments and similar administrative steps are modest by comparison. Ongoing compliance costs - including annual reviews, staff training, and incident response readiness - should be factored into operational budgets.

Should a business operating across the Gulf Cooperation Council implement a single regional data protection framework or separate country-specific programmes?

A unified regional framework is operationally attractive but carries compliance risk if it is calibrated to the lowest common denominator across jurisdictions. Saudi Arabia';s PDPL is among the more demanding frameworks in the region, with specific requirements around sensitive data, cross-border transfers, and DPO appointment that differ from the requirements in other Gulf states. A pragmatic approach is to build a core framework that addresses the most stringent requirements - which in most cases means the Saudi standard - and then layer jurisdiction-specific adaptations on top. This avoids the cost of entirely separate programmes while ensuring that Saudi-specific obligations are not diluted by a regional averaging approach. Legal advice specific to each jurisdiction is advisable before finalising the structure.

Saudi Arabia';s data protection environment is maturing rapidly. The Q4 2025 developments - covering enforcement, cross-border transfers, sector-specific guidance, and DPO requirements - signal that SDAIA is moving toward active, consistent enforcement of the PDPL. Businesses that have treated compliance as a future concern should treat it as a current operational priority. The cost of remediation after an enforcement action is invariably higher than the cost of proactive compliance.

VLO Law Firms advises international clients on data protection matters in Saudi Arabia. We can assist with PDPL compliance assessments, DPO appointment, data processing agreements, cross-border transfer frameworks, and regulatory correspondence with SDAIA. To request a consultation, contact: info@vlolawfirm.com