Data Protection Update in Saudi Arabia: Q2 2026

Saudi Arabia data protection 2026 is a fast-moving area that every business operating in the Kingdom must monitor closely. The Personal Data Protection Law (PDPL), enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA), has entered a more active enforcement phase, with implementing regulations tightened and compliance expectations rising. This guide covers the most significant recent developments, their practical implications for local and foreign businesses, and the steps organisations should take now to stay ahead of regulatory risk.

The PDPL was first enacted by Royal Decree M/19 and has since been supplemented by executive regulations that clarify obligations around consent, cross-border data transfers, data subject rights, and breach notification. Recent amendments to the executive regulations have sharpened several requirements that were previously ambiguous.

One of the most consequential recent changes concerns the cross-border transfer of personal data. Under the current framework, transferring personal data outside Saudi Arabia requires either the data subject';s explicit consent or a determination that the recipient country provides an adequate level of protection. SDAIA has begun publishing guidance on what "adequate protection" means in practice, moving away from a purely case-by-case assessment toward a more structured adequacy framework. Businesses that previously relied on broad consent clauses should review whether those clauses meet the updated specificity requirements.

The definition of sensitive personal data has also been clarified. Health data, financial data, genetic information, and data relating to minors now attract heightened obligations, including mandatory data protection impact assessments (DPIAs) before processing begins. Organisations that process these categories without a completed DPIA are exposed to enforcement action even if no breach has occurred.

A non-obvious requirement that many foreign-owned entities overlook is the obligation to appoint a Data Protection Officer (DPO) where processing is carried out on a large scale or involves sensitive categories. The DPO must be registered with SDAIA, and the registration process itself requires documentation that takes several weeks to prepare correctly.

SDAIA has signalled a shift from a guidance-first posture to active enforcement. Recent public statements from the Authority confirm that it is conducting sector-specific audits, with healthcare, financial services, and e-commerce identified as priority areas. Organisations in these sectors should treat an audit as a near-term possibility rather than a remote risk.

Penalties under the PDPL can reach significant levels. Violations involving sensitive personal data or intentional breaches attract the highest tier of fines, while procedural failures - such as failing to maintain a data processing register or failing to respond to data subject requests within the prescribed period - attract lower but still material penalties. Repeat violations can result in fines being doubled.

In practice, enforcement has focused on three recurring failures:

• Inadequate or missing privacy notices that do not meet the content requirements set out in the executive regulations.
• Cross-border transfers conducted without a valid legal basis documented in writing.
• Breach notifications submitted late or with insufficient detail.

A common mistake among multinational companies is assuming that a group-level privacy policy drafted for another jurisdiction satisfies Saudi requirements. Saudi law requires localised notices that address the specific rights available to Saudi data subjects, including the right to access, correct, and request deletion of personal data.

Cross-border data transfer rules remain one of the most operationally complex aspects of saudi arabia data protection 2026 compliance. The executive regulations establish a tiered approach. Transfers to countries with an SDAIA adequacy determination are straightforward. Transfers to other countries require either explicit, informed consent from the data subject or the use of contractual safeguards approved by SDAIA.

SDAIA has indicated that it will publish a list of countries with adequacy status, but that list remains incomplete. In the interim, organisations relying on contractual safeguards must ensure their data processing agreements contain the specific clauses required under Saudi law, which differ in several respects from standard EU-style standard contractual clauses.

A practical scenario: a European technology company providing cloud services to a Saudi hospital must ensure that any patient data processed on servers outside the Kingdom is covered by a valid transfer mechanism. Relying on the hospital';s own consent forms is insufficient if those forms do not specifically disclose the cross-border transfer and identify the recipient country.

A second scenario: a Saudi e-commerce platform using a US-based analytics provider must document the legal basis for the transfer, maintain that documentation in its data processing register, and be able to produce it on request during an SDAIA audit. Many platforms have the transfer in place but lack the documentation, which is itself a violation.

If your organisation is navigating cross-border transfer requirements or preparing for an SDAIA audit, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

The PDPL grants Saudi data subjects a set of enforceable rights that organisations must operationalise, not merely acknowledge in a privacy policy. The right to access personal data, the right to correction, the right to erasure in defined circumstances, and the right to object to processing for direct marketing purposes are all active obligations.

The prescribed response period for data subject requests is 30 days from receipt, with a possible extension of a further 30 days in complex cases, provided the data subject is notified of the extension before the initial period expires. Organisations that fail to respond within this window are in breach regardless of whether the underlying request is ultimately granted or refused.

Breach notification obligations have also been clarified. A personal data breach that is likely to result in harm to data subjects must be notified to SDAIA within 72 hours of the organisation becoming aware of it. Notification to affected data subjects is required where the breach poses a high risk of harm. The notification must include specific information about the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed.

Many organisations underestimate the operational readiness required to meet the 72-hour notification window. In practice, this means having an incident response plan in place before a breach occurs, with clear internal escalation paths and pre-drafted notification templates that can be adapted quickly.

The obligation to maintain a data processing register - a record of all processing activities carried out by the organisation - applies to all controllers, not only large organisations. The register must be kept up to date and made available to SDAIA on request. Foreign companies with Saudi operations frequently maintain group-level records that do not capture Saudi-specific processing activities in sufficient detail.

Several sector-specific developments are shaping the practical application of Saudi data protection rules. The healthcare sector has seen the most active regulatory attention, with SDAIA coordinating with the Ministry of Health on standards for the processing of patient data in digital health platforms. Organisations operating in this space must comply with both the PDPL and sector-specific health data regulations, which in some respects impose stricter requirements.

The financial sector is subject to additional guidance from the Saudi Central Bank (SAMA), which has issued its own cybersecurity and data management frameworks. Financial institutions must reconcile SAMA requirements with PDPL obligations, and where the two frameworks overlap, the stricter standard generally applies. A common mistake is treating SAMA compliance as a substitute for PDPL compliance; the two frameworks are complementary, not interchangeable.

Artificial intelligence and automated decision-making are emerging areas of regulatory focus. SDAIA, as the authority responsible for both data protection and AI governance, has signalled that it intends to issue guidance on the use of personal data in AI training and on the rights of individuals subject to automated decisions. Organisations developing or deploying AI systems that process personal data should begin mapping their data flows now, before specific AI-related obligations are formalised.

The processing of children';s data is another area attracting increased attention. The executive regulations require verifiable parental consent for the processing of data relating to minors, and platforms that cannot demonstrate a reliable age verification mechanism are at risk. This is particularly relevant for consumer-facing applications and social platforms with a Saudi user base.

Organisations that have not yet conducted a full PDPL compliance review should treat this as an immediate priority. The following areas represent the highest-risk gaps identified in recent practice:

• Privacy notices: review and update to ensure they meet current content requirements, including specific disclosure of cross-border transfers and data subject rights.
• Data processing register: ensure it captures all Saudi-specific processing activities, including those carried out by processors on the organisation';s behalf.
• DPO appointment and registration: confirm whether the obligation applies and, if so, complete the SDAIA registration process.
• Cross-border transfer documentation: identify all transfers, confirm the legal basis for each, and document that basis in writing.
• Incident response plan: establish or update the plan to ensure the 72-hour notification window is operationally achievable.

In practice, founders and compliance officers should consider that SDAIA audits are increasingly unannounced and sector-targeted. Waiting for a formal inquiry before addressing gaps is a high-risk strategy. Organisations that can demonstrate a documented compliance programme - even one that is still maturing - are treated more favourably than those with no programme at all.

A non-obvious requirement is that processors, not only controllers, now have direct obligations under the PDPL. If your organisation provides services to Saudi businesses and processes personal data on their behalf, you are subject to the law';s requirements regardless of where your organisation is incorporated.

Does the PDPL apply to foreign companies with no physical presence in Saudi Arabia?

The PDPL applies to any processing of personal data relating to individuals in Saudi Arabia, regardless of where the processing organisation is located. A foreign company that collects data from Saudi residents through a website, app, or service is subject to the law. The practical enforcement of this extraterritorial scope is still developing, but organisations with significant Saudi user bases should not assume that the absence of a local entity removes their obligations. SDAIA has the authority to take action against foreign entities, and reputational and contractual risks exist independently of direct regulatory enforcement.

How long does it take to achieve PDPL compliance, and what does it cost?

The timeline depends heavily on the organisation';s starting point and the complexity of its data processing activities. A small business with straightforward processing activities might complete a compliance review and implement necessary changes within six to ten weeks. A large organisation with complex cross-border data flows, multiple processors, and sensitive data categories should budget several months for a thorough programme. Professional fees for a compliance review typically start from the low thousands of USD for smaller engagements and scale upward with complexity. Internal resource costs - staff time for policy updates, training, and system changes - are often the larger component and are frequently underestimated.

What is the difference between a data controller and a data processor under Saudi law, and why does it matter?

A data controller is the entity that determines the purposes and means of processing personal data. A data processor is an entity that processes data on behalf of a controller. The distinction matters because controllers and processors have different but overlapping obligations under the PDPL. Controllers bear primary responsibility for compliance, including obtaining valid consent, issuing privacy notices, and responding to data subject requests. Processors must act only on documented instructions from the controller, maintain their own data processing records, and notify the controller promptly of any breach. Contracts between controllers and processors must include specific clauses required by the executive regulations. Many service provider agreements in use today were drafted before these requirements were clarified and need to be updated.

Saudi Arabia';s data protection framework is maturing quickly, and the gap between formal compliance and operational readiness is closing. Organisations that treat PDPL compliance as a one-time exercise rather than an ongoing programme are increasingly exposed to enforcement risk. The priority areas - cross-border transfers, breach notification, data subject rights, and sector-specific obligations - require concrete operational measures, not just policy documents.

VLO Law Firms advises international clients on data protection matters in Saudi Arabia. We can assist with PDPL compliance reviews, DPO registration, cross-border transfer documentation, data processing agreements, and incident response planning. To request a consultation, contact: info@vlolawfirm.com