Saudi Arabia

Saudi Arabia data protection & cybersecurity regulation

Saudi Arabia's Personal Data Protection Law (PDPL) is enforced by the Saudi Data & AI Authority (SDAIA), which has been actively issuing enforcement decisions and multi-million-riyal fines; a statutory option exists to later transfer oversight to the National Data Management Office (NDMO), but no such transfer has occurred as of the most recent commentary reviewed.

Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.

Applicable laws

Personal Data Protection Law (Royal Decree No. M/19, as amended by Royal Decree No. M/148)(PDPL)

Saudi Arabia's comprehensive cross-sector personal data protection law, originally issued in September 2021 and substantively amended in 2023 before its full enforceability (confirmed effective September 2023). Applies to processing of personal data of individuals within Saudi Arabia, including by entities outside the Kingdom processing the data of KSA residents.

Source

Implementing Regulations of the PDPL(PDPL Implementing Regulations)

Detailed operational regulations issued by SDAIA covering consent mechanisms, data subject rights procedures, cross-border transfer safeguards, and, per Article 24, data breach notification timelines and content requirements.

Source

Breach notification

72 hours

Article 24 of the PDPL Implementing Regulations requires controllers to notify SDAIA within 72 hours of becoming aware of a breach that may cause harm to personal data or to the data subject's rights or interests, via SDAIA's National Data Governance Portal, including a description of the breach, affected categories/numbers of data subjects, and remediation measures. Notification to affected individuals must be made without undue delay where serious harm is likely.

Notify: Saudi Data & AI Authority (SDAIA)

Source

Statutory maximum fines

Published legal maximums, not a personalized estimate, not legal advice.

PDPL, general violations

Warning or fine up to SAR 5,000,000 (approx. USD 1.33 million)

For repeat violations, courts/enforcement committees may double the fine, effectively up to SAR 10,000,000. SDAIA's enforcement committees have issued dozens of confirmed violation decisions covering processing without a valid legal basis, unauthorized disclosure, inadequate technical/organizational safeguards, and unconsented marketing communications.

Source

PDPL, intentional disclosure of sensitive data causing harm

Up to 2 years imprisonment and/or a fine up to SAR 3,000,000

A separate, more severe criminal-adjacent tier applying specifically to intentional unlawful disclosure of sensitive personal data where harm results, alongside possible confiscation of proceeds and court-ordered publication of the judgment.

Source

NIS2 status

Not applicable , as of 2026-09-08

Primary authority

Saudi Data & AI Authority(SDAIA)

Visit authority site

Working in Saudi Arabia?

See our regional security services

Tools

Frequently asked

Is SDAIA still the enforcement authority for the Saudi PDPL?

As of the most recent commentary reviewed, SDAIA continues to lead PDPL enforcement and is actively issuing fines and violation decisions. The PDPL contemplates a possible future transfer of oversight to the National Data Management Office (NDMO), contingent on a government maturity assessment, but no formal transfer had been announced at time of writing.

How fast must a breach be reported under the Saudi PDPL?

Controllers must notify SDAIA within 72 hours of becoming aware of a breach that may harm personal data or a data subject's rights or interests, per Article 24 of the PDPL Implementing Regulations. Affected individuals must be notified without undue delay where serious harm is likely.

What is the maximum fine for a PDPL violation in Saudi Arabia?

General violations can draw a warning or a fine of up to SAR 5 million, doubled to up to SAR 10 million for repeat offenses. A separate, harsher tier applies to intentional disclosure of sensitive data causing harm: up to 2 years imprisonment and/or a fine of up to SAR 3 million.