Saudi Personal Data Protection Law (PDPL): what it means for your app or system
By Al-Arjan7 min read
What is the PDPL and who supervises it?
The PDPL sets how organisations collect, use, store and destroy personal data. It entered into force on 14 September 2023, the one-year grace period ended on 14 September 2024, and since then the Saudi Data and Artificial Intelligence Authority (SDAIA) has enforced it in full.
The point many miss: the law also applies to organisations outside the Kingdom that process the data of people residing in Saudi Arabia. Any app or store serving Saudi customers is in scope.
What does it mean for how your app or system is designed?
In practice the system must be built to: collect only the data needed for a specific purpose, state in the privacy policy the data types, purpose and legal basis, destroy a person’s data on request or when consent is withdrawn — including backups — and keep a record of processing activities.
It also needs fine-grained permissions on who sees data, encryption, masking or pseudonymisation where possible, and a plan for reporting any breach. Security basics are in software security basics and data backup.
PDPL requirements and their system equivalent
Data minimisation
- What is built into the system:
- Only necessary fields in forms and the app
Transparency
- What is built into the system:
- A clear privacy policy and consent screen
Destruction on request
- What is built into the system:
- Delete a person’s data from the database and backups
Record of processing
- What is built into the system:
- Document what is collected, why and who accesses it
Security
- What is built into the system:
- Permissions, encryption and masking of sensitive data
| Requirement | What is built into the system |
|---|---|
| Data minimisation | Only necessary fields in forms and the app |
| Transparency | A clear privacy policy and consent screen |
| Destruction on request | Delete a person’s data from the database and backups |
| Record of processing | Document what is collected, why and who accesses it |
| Security | Permissions, encryption and masking of sensitive data |
Want the cost and timeline for your specific project?
Get a quote in two minutesWhat about hosting and transferring data outside the Kingdom?
Transferring personal data outside the Kingdom is restricted. The amended transfer regulation narrows acceptable safeguards to SDAIA’s standard contractual clauses, binding corporate rules and accreditation certificates, with a risk assessment in certain cases. So the hosting location must be decided early in the analysis, not after launch. Hosting options are in cloud or on-premises.
How does Al-Arjan account for the PDPL on Saudi projects?
In the analysis we define the personal data your system will collect, where it is hosted, the permissions and the destruction method, and build that into the app or custom system from the start. Final legal review of the privacy policy belongs to your legal adviser. More in Al-Arjan in Saudi Arabia.
Frequently asked questions
When did the PDPL become fully enforceable?
On 14 September 2024, after a one-year grace period from entry into force on 14 September 2023.
Who enforces the law?
The Saudi Data and Artificial Intelligence Authority (SDAIA).
Does it apply to a company outside Saudi Arabia?
Yes, if it processes the personal data of people residing in the Kingdom.