Legislation / ActMiddle East · Saudi Arabia

Saudi Personal Data Protection Law (Saudi PDPL)

Saudi Arabia's personal data protection law, administered by SDAIA.

Request an Assessment

Verify current status

Implementing Regulations have been amended; draft further amendments were consulted in 2026 — verify current text with SDAIA.

Classification

Legislation / Act

Issuing authority

Kingdom of Saudi Arabia (Royal Decree M/19, amended M/148); SDAIA

Jurisdiction

Middle East · Saudi Arabia · Sector: All

Status / edition

In force and enforceable

Key dates

Royal Decree M/19 (2021), amended M/148 (2023); Implementing Regulations published 7 Sep 2023; in force 14 Sep 2023; grace period ended 14 Sep 2024

Mandatory or voluntary

Conditional

Who it applies to

Processing of personal data of individuals in Saudi Arabia, including by entities outside the Kingdom in certain cases.

Purpose

Saudi Arabia's personal data protection law, administered by SDAIA.

Major requirements / obligations

  • Lawful basis and consent
  • Data subject rights
  • Registration/DPO where applicable
  • Cross-border transfer rules

Control domains

PrivacyGovernance

Official reference

https://sdaia.gov.sa/en/SDAIA/about/Pages/PersonalData.aspx ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.