Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024 and reaches foreign organisations that process data about people in the Kingdom. It is administered by the Saudi Data and Artificial Intelligence Authority (SDAIA), which runs the controller register, breach reporting and transfer rules. Cybersecurity controls from the National Cybersecurity Authority bind government-linked entities and critical infrastructure operators, and ZATCA's e-invoicing integration now reaches businesses with modest VAT turnover. A draft amendment published in October 2026 would add a general requirement to store personal data inside the Kingdom.
Who the PDPL applies to and what it costs to get wrong
The PDPL covers processing of personal data in the Kingdom and processing by organisations outside the Kingdom of personal data about individuals located there. A foreign parent running a Saudi customer database from its home country, or a SaaS provider serving Saudi users, should assume it is in scope.
Administrative penalties reach SAR 5 million per violation, with doubling possible for repeat breaches. Unlawfully disclosing or publishing sensitive data with intent to harm or for personal benefit is a crime carrying up to two years' imprisonment and a fine of up to SAR 3 million. The law has been fully enforceable since 14 September 2024, after a one-year transition.1234
Registration, data protection officers and breach reporting
SDAIA's rules require public entities, controllers whose main activity is processing personal data and controllers processing sensitive data to register on the National Register of Controllers through the National Data Governance Platform. Certificates last up to five years and are publicly visible. A data protection officer is mandatory where core activities involve regular and systematic monitoring or sensitive data, and for public entities processing at large scale; the role can be outsourced.
Controllers must notify SDAIA of a breach that may cause harm within 72 hours of becoming aware of it and tell affected individuals without undue delay. Businesses that process sensitive data should plan for both registration and a DPO from the start.5678
Transferring data out of the Kingdom, and the localisation proposal
Transfers abroad are allowed only for purposes the PDPL lists, must not harm national security or the Kingdom's vital interests, and must be limited to the minimum data needed. In practice most groups rely on SDAIA's own standard contractual clauses or binding common rules, which lift the adequacy and minimum-data conditions but require a documented transfer risk assessment. SDAIA's clauses cannot be edited beyond the blanks and are needed even where EU clauses are already signed.
On 6 October 2026 SDAIA opened consultation, running to 5 November 2026, on amendments that would require controllers to store personal data inside the Kingdom while still permitting transfers under the PDPL, remove the harm threshold for breach notification to SDAIA, and extend registration to anyone transferring data abroad. These are not yet law; if adopted they take effect 60 days after publication in the Official Gazette. Sector rules already restrict some flows: the cloud framework does not allow sensitive business content or highly sensitive government content to leave the Kingdom unless the law allows it.910111213
Cybersecurity controls and e-invoicing integration
The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) are mandatory for government bodies, their companies inside and outside the Kingdom, and private operators of critical national infrastructure; suppliers to these entities usually inherit the controls by contract. ECC-2:2024 removed the old ECC hosting-in-Kingdom control and refers localisation to the National Data Management Office, but remote-access managed security operations centres must still be fully located in the Kingdom.
E-invoicing is a technology obligation for every VAT-registered business. Phase One has applied since 4 December 2021. Phase Two integration with ZATCA's Fatoora platform is rolled out in waves; the 25th wave covers taxpayers with VAT-subject revenue above SAR 187,500 in any year from 2022 to 2025 and must integrate by 1 February 2027.14151617
| Obligation | Applies to | Key point | Authority |
|---|---|---|---|
| PDPL compliance | Processing in the Kingdom or of data about people in the Kingdom | Fines up to SAR 5 million per violation | SDAIA |
| Controller registration | Public entities; controllers whose main activity is processing; sensitive-data processors | Certificate valid up to five years | SDAIA (National Data Governance Platform) |
| Breach notification | All controllers | 72 hours where the breach may cause harm | SDAIA |
| Cross-border transfer | Any transfer outside the Kingdom | SDAIA clauses or binding common rules plus a transfer risk assessment | SDAIA |
| Essential Cybersecurity Controls | Government entities and their companies; critical infrastructure operators | 4 domains, 108 main controls | National Cybersecurity Authority |
| E-invoicing Phase Two (wave 25) | VAT-subject revenue above SAR 187,500 in 2022 to 2025 | Integrate with Fatoora by 1 February 2027 | ZATCA |
How it works, step by step
- Map personal data held about individuals in the Kingdom, including data processed from abroad, and identify sensitive data.1Internal (controller)
- Check whether the business must register on the National Register of Controllers and appoint a data protection officer; register through the National Data Governance Platform if so.56SDAIA
- Put SDAIA standard contractual clauses or binding common rules in place for transfers abroad and complete a transfer risk assessment.1011SDAIA
- Adopt a breach response plan that can notify SDAIA within 72 hours and inform affected individuals.8SDAIA
- Confirm the e-invoicing wave that applies and integrate the invoicing system with the Fatoora platform by the notified date.17ZATCA
No timings or fees are shown unless an official source states them.
Documents usually needed
- Record of processing activities
- Arabic-available privacy policy naming the controller and data protection officer
- SDAIA standard contractual clauses or approved binding common rules for intra-group transfers
- Transfer risk assessment
- National Register of Controllers registration certificate (where required)
- Breach response plan and notification templates
Common mistakes
- Assuming the PDPL does not apply because the data is hosted or processed outside the Kingdom.
- Relying on EU standard contractual clauses alone for transfers out of Saudi Arabia.
- Editing SDAIA's standard contractual clauses beyond the blank fields, which invalidates them.
- Missing the 72-hour breach notification window because the incident plan follows a different country's timetable.
- Treating e-invoicing as an accounting task and starting Fatoora integration too late for the notified wave date.
When the business crosses borders
- Group shared-service centres and global HR or CRM systems that receive Saudi personal data need a PDPL transfer basis, usually SDAIA clauses or binding common rules, plus a transfer risk assessment.
- If SDAIA's October 2026 localisation draft is adopted, controllers would need a copy of personal data stored inside the Kingdom; architecture decisions for new platforms should allow for this.
- Suppliers to Saudi government bodies and critical infrastructure operators should expect ECC-2:2024 controls, including in-Kingdom location for remote managed security services, to flow down through contracts.
Questions businesses ask
Do we need to keep Saudi personal data in Saudi Arabia?
Not as a general PDPL rule today: transfers are allowed with a lawful basis and safeguards. Sector rules restrict some content, and a draft amendment published in October 2026 would introduce a general in-Kingdom storage requirement while still permitting transfers.91213
Who enforces the PDPL and how large are the fines?
SDAIA administers the law. Administrative fines reach SAR 5 million per violation and can be doubled for repeat breaches; unlawful disclosure of sensitive data is a crime with up to two years' imprisonment.23
Does a small foreign-owned company have to join e-invoicing Phase Two?
Phase Two applies wave by wave. The 25th wave covers taxpayers with VAT-subject revenue above SAR 187,500 in any year from 2022 to 2025, so many small businesses are now included; ZATCA notifies those selected.17
What this guide does not yet confirm
These points need checking with a qualified local professional in Saudi Arabia before you rely on them.
- The official PDPL Implementing Regulations, Transfer Regulation and SDAIA rules on its platform could not yet be checked; breach timing, registration, DPO and transfer points rely on law-firm summaries.
- The outcome and final text of SDAIA's October 2026 draft amendments (localisation, breach notification, registration) are not known.
- SDAIA's list of adequate jurisdictions, if published, was not checked.
- The current Cloud Computing Regulatory Framework and NDMO data classification and localisation rules could not yet be checked; sector regulators (SAMA, health) may impose stricter localisation.
- The ECC-2:2024 commencement date was not confirmed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The PDPL applies to processing of personal data in the Kingdom and to processing by organisations outside the Kingdom of personal data of individuals located in the Kingdom.
Secondary summary of PDPL Article 2; Article 2 of the official translation was not separately extracted.
The Personal Data Protection Law (PDPL) allows controllers to be fined up to SAR 5 million, or given a warning, for violations other than the criminal offence of unlawfully disclosing sensitive data. Fines may be doubled for repeat violations, up to twice the maximum. Imposed by the competent authority's violations committee.
English text is a translation hosted on an official government site; the Arabic text published by the Bureau of Experts prevails.
Disclosing or publishing sensitive personal data in breach of the PDPL with intent to harm the data subject or for personal benefit is a criminal offence punishable by up to two years' imprisonment, a fine of up to SAR 3 million, or both. Applies to any person, not only controllers. Prosecuted through the Public Prosecution.
The PDPL framework became fully enforceable on 14 September 2024, at the end of a one-year transition period that followed the law's entry into force on 14 September 2023.
Secondary source; official SDAIA announcement not yet checked. Dates are consistent across several law-firm summaries.
SDAIA's rules require registration on the National Register of Controllers, via the National Data Governance Platform, for public entities, controllers whose main activity is processing personal data, and controllers processing sensitive data. Registration certificates are valid for up to five years and must be made publicly available. A draft amendment of October 2026 would extend mandatory registration to controllers transferring or disclosing data outside the Kingdom.
Secondary source summarising SDAIA's Rules Governing the National Register of Controllers; official text not yet checked.
A data protection officer must be appointed where a public entity carries out large-scale processing, or where a controller's core activities involve regular and systematic monitoring of individuals or processing of sensitive data. The DPO may be an employee or an external contractor; appointment must be in writing and contact details provided to SDAIA via its platform.
Secondary source summarising SDAIA's Rules for Appointing a Personal Data Protection Officer.
A controller must notify the competent authority of any breach, damage or unlawful access to personal data, and must notify the data subject where the incident could damage their data or prejudice their rights. Timing and content are set by the Implementing Regulations (see sa-data-005).
Under the PDPL Implementing Regulations, a controller must notify SDAIA within 72 hours of becoming aware of a personal data breach that may cause harm to personal data or the data subject, and must inform affected data subjects without undue delay. Current threshold is likely harm. A draft amendment published for consultation in October 2026 would remove the harm threshold for notification to SDAIA (see sa-data-012).
Secondary source: the official Implementing Regulations page on SDAIA's platform could not yet be checked run.
Under the PDPL, a controller may transfer personal data outside the Kingdom only for purposes the law lists, must not prejudice national security or the Kingdom's vital interests, and must limit the transfer to the minimum data needed. Exceptions for extreme necessity to protect life or vital interests, or to prevent, examine or treat disease (Article 29(3)). Detailed conditions are in the Regulation on Personal Data Transfer outside the Kingdom.
Controllers that transfer personal data abroad using SDAIA's standard contractual clauses, binding common rules or an accreditation certificate are exempt from the PDPL's adequacy and minimum-data transfer conditions, but must carry out a transfer risk assessment. A risk assessment is also required for continuous or widespread transfers of sensitive data. SDAIA publishes the list of jurisdictions it considers adequate and may suspend transfers to a jurisdiction.
Secondary summary of the amended Regulation on Personal Data Transfer outside the Kingdom.
SDAIA's standard contractual clauses cannot be altered beyond completing the blank fields, and organisations must use them even if they already rely on EU standard contractual clauses.
Secondary source.
On 6 October 2026 SDAIA opened public consultation, until 5 November 2026, on draft amendments to the PDPL Implementing Regulations that would require controllers to store personal data in the Kingdom and remove the harm threshold for breach notification to SDAIA. Draft only, not in force. If adopted, the amendments take effect 60 days after publication in the Official Gazette. Transfers abroad would remain possible under the PDPL and its regulations.
Pending change. Secondary source; the consultation documents on the Istitlaa platform could not yet be checked.
The Cloud Computing Regulatory Framework does not permit cross-border transfer of sensitive business content or highly sensitive government content unless Saudi law expressly allows it. Applies to content classified at the higher levels under the CST framework; lower-classified content is not restricted in the same way.
Secondary (foreign government) summary. The current CST framework text could not yet be checked; check the latest version with the Communications, Space and Technology Commission.
The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) are mandatory for government entities and their affiliated companies inside and outside the Kingdom, and for private sector entities that own, operate or host critical national infrastructure. Other entities are encouraged to adopt them. ECC-2:2024 has 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols. NCA assesses compliance by self-assessment, compliance-tool reports and field audits.
Effective date shown as 2024 edition; exact commencement date not stated in the extract.
ECC-2:2024 deleted the earlier ECC control requiring entity information to be hosted and stored inside the Kingdom, and refers data localisation questions to the National Data Management Office (NDMO) under SDAIA, while still requiring remote-access cybersecurity managed service centres to be fully located in the Kingdom. Applies to entities in scope of ECC (see sa-data-013).
ZATCA's e-invoicing Phase One (generation) has applied since 4 December 2021, requiring taxpayers to issue invoices through compliant electronic solutions rather than by hand or with spreadsheets or text editors. Applies to VAT-registered taxpayers.
ZATCA's 25th wave of e-invoicing Phase Two (integration) covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, and requires them to integrate their e-invoicing solutions with the Fatoora platform by 1 February 2027. ZATCA notifies targeted taxpayers directly and announces each wave at least six months before its integration date.
Questions on this topic
17 statements on data protection, cybersecurity and digital filing in Saudi Arabia
