# Saudi Personal Data Protection Law (PDPL): what it means for your app or system

> Saudi Arabia’s Personal Data Protection Law has been in force since 14 September 2023 and fully enforced by SDAIA since 14 September 2024, and it applies even to organisations outside the Kingdom that process its residents’ data. Your app must collect the minimum data needed, explain its privacy policy, destroy data on request and control transfers abroad.

Source: https://www.al-arjan.com/en/blog/saudi-pdpl-software-guide · العربية: https://www.al-arjan.com/ar/blog/saudi-pdpl-software-guide.md

Author: Al-Arjan — Published 2026-11-11

## What is the PDPL and who supervises it?

The PDPL sets how organisations collect, use, store and destroy personal data. It entered into force on 14 September 2023, the one-year grace period ended on 14 September 2024, and since then the Saudi Data and Artificial Intelligence Authority (SDAIA) has enforced it in full.

The point many miss: the law also applies to organisations outside the Kingdom that process the data of people residing in Saudi Arabia. Any app or store serving Saudi customers is in scope.

## What does it mean for how your app or system is designed?

In practice the system must be built to: collect only the data needed for a specific purpose, state in the privacy policy the data types, purpose and legal basis, destroy a person’s data on request or when consent is withdrawn — including backups — and keep a record of processing activities.

It also needs fine-grained permissions on who sees data, encryption, masking or pseudonymisation where possible, and a plan for reporting any breach. Security basics are in [software security basics](https://www.al-arjan.com/en/blog/software-security-basics) and [data backup](https://www.al-arjan.com/en/blog/data-backup).

### PDPL requirements and their system equivalent
| Requirement | What is built into the system |
|---|---|
| Data minimisation | Only necessary fields in forms and the app |
| Transparency | A clear privacy policy and consent screen |
| Destruction on request | Delete a person’s data from the database and backups |
| Record of processing | Document what is collected, why and who accesses it |
| Security | Permissions, encryption and masking of sensitive data |

## What about hosting and transferring data outside the Kingdom?

Transferring personal data outside the Kingdom is restricted. The amended transfer regulation narrows acceptable safeguards to SDAIA’s standard contractual clauses, binding corporate rules and accreditation certificates, with a risk assessment in certain cases. So the hosting location must be decided early in the analysis, not after launch. Hosting options are in [cloud or on-premises](https://www.al-arjan.com/en/blog/cloud-vs-onprem).

## How does Al-Arjan account for the PDPL on Saudi projects?

In the analysis we define the personal data your system will collect, where it is hosted, the permissions and the destruction method, and build that into the [app](https://www.al-arjan.com/en/services/mobile-apps) or [custom system](https://www.al-arjan.com/en/services/custom-software) from the start. Final legal review of the privacy policy belongs to your legal adviser. More in [Al-Arjan in Saudi Arabia](https://www.al-arjan.com/en/saudi-arabia).

## Frequently asked questions

### When did the PDPL become fully enforceable?

On 14 September 2024, after a one-year grace period from entry into force on 14 September 2023.

### Who enforces the law?

The Saudi Data and Artificial Intelligence Authority (SDAIA).

### Does it apply to a company outside Saudi Arabia?

Yes, if it processes the personal data of people residing in the Kingdom.

---

Contact Al-Arjan: +964 773 545 2792 (phone & WhatsApp, 24/7) — [Request a quote](https://www.al-arjan.com/en/quote)