🇸🇦
Saudi Arabia
Personal Data Protection Law (PDPL) 2021
Middle East🔵 Substantial
Compliance Score
86%
12 Addressed
2 Partial
0 None
Authority
Saudi Data & AI Authority (SDAIA)
Overview
Saudi Arabia's PDPL, effective 2023, applies to processing of personal data within Saudi Arabia and extraterritorially. SDAIA oversees enforcement. The law includes data localisation provisions and imposes significant penalties for non-compliance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
AddressedDPO Requirements
AddressedChildren's Data
AddressedPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
AddressedAI & Automated Decisions
AddressedData Localisation
AddressedSignificant Data Fiduciary
AddressedGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Saudi Arabia?+
Saudi Arabia is governed by the Personal Data Protection Law (PDPL) 2021. The law is enforced by the Saudi Data & AI Authority (SDAIA). According to our analysis, the country has a Substantial level of data protection framework.
Does Saudi Arabia require a Data Protection Officer (DPO)?+
Yes, under the Personal Data Protection Law (PDPL) 2021, organizations are generally required to appoint a Data Protection Officer (DPO) or a similar privacy officer to ensure compliance.
What are the data localisation rules in Saudi Arabia?+
Yes, Saudi Arabia has strict data localisation requirements. The Personal Data Protection Law (PDPL) 2021 may require certain types of personal data to be stored within the country's borders.
What are the breach notification requirements in Saudi Arabia?+
Under the Personal Data Protection Law (PDPL) 2021, organizations must notify the Saudi Data & AI Authority (SDAIA) and affected individuals without undue delay in the event of a personal data breach.