If your company collects customers' names, numbers or IDs, it is bound by the Saudi Personal Data Protection Law (PDPL), supervised by the Saudi Data and AI Authority (SDAIA).
Individuals' rights
| Right | In practice |
|---|---|
| To be informed | Why your data is collected and on what basis |
| Access | A copy of your data held by the entity |
| Correction | Fixing wrong or incomplete data |
| Destruction | Deletion when no longer needed, within the law's limits |
| Withdrawal of consent | For processing based on consent |
Company obligations
- A clear, published privacy notice.
- Data minimisation: collect only what the purpose needs.
- A lawful basis for processing: consent or another basis set by the law.
- Security measures and breach notification within the statutory period.
- Restrictions on transfers outside the Kingdom.
- No direct marketing without consent.
Penalties
Criminal penalties apply to disclosing sensitive data to cause harm or gain, and fines that can reach millions of riyals for other breaches, doubled on repetition, plus compensation to those harmed. Check the current official text and regulations.
What your company should do now
- Map the data you collect, where it is stored and who accesses it.
- Update website forms and contracts with notice and consent.
- Review service-provider contracts (hosting, marketing, HR systems).
- Appoint a data protection lead and a breach plan.
Need to comply?
Usus Law Firm reviews privacy policies and contracts as part of corporate governance and contract drafting, in Riyadh and Tabuk, and advises in English.
This article is general legal information and is not a substitute for advice on your specific case. Court proceedings in Saudi Arabia are in Arabic; the official Arabic text of each law prevails.
Request a quick consultation
Leave your name and mobile number, and a lawyer from our Riyadh or Tabuk office will call you during working hours. We advise in English.
