PDPL Personal Data Protection Law: Company Guide
PDPL imposes strict rules on collecting, processing, and storing personal data. We explain the basic requirements — in simple language.
What is PDPL?
PDPL is Saudi Arabia's Personal Data Protection Law. Issued in September 2021 and fully effective since September 2023. Supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
Applies to: every entity collecting or processing personal data in Saudi Arabia — government, private, or even individuals.
Core Principles
1. Consent
Do not collect personal data without explicit consent. Consent must be:
- Clear and specific
- Revocable at any time
- Documented
2. Minimization
Collect only the data you need — no more. If you need name and email only, do not ask for phone number.
3. Transparency
Tell the user: what you collect, why, and who has access.
4. Security
Protect data with encryption, permissions, and monitoring. A breach = your responsibility.
5. Right to Deletion
Users can request data deletion. You must delete within a reasonable period.
Hosting Requirements
PDPL imposes direct requirements on infrastructure:
| Requirement | Details |
|---|---|
| Storage location | Sensitive data must be in Saudi Arabia |
| Encryption | Mandatory in transit and at rest |
| Backup | Regular and encrypted |
| Access logs | Preserved for specified period |
| Breach notification | Within 72 hours |
Penalties
| Violation | Penalty |
|---|---|
| Collection without consent | Up to 3 million SAR |
| Transfer outside Kingdom without permission | Up to 5 million SAR |
| Failure to report breach | Up to 5 million SAR |
| Repeat violation | Double fine + imprisonment |
How to Comply
- Saudi server — first and most important step
- Clear privacy policy on your website
- Consent form for data collection
- Data encryption in transit (SSL) and at rest
- Deletion procedure when user requests
- Incident response plan ready
- Employee training on data handling
CLOUD and PDPL
CLOUD servers are in Riyadh. Data never leaves Saudi Arabia. Free SSL with every server. Daily backup. Strong start for compliance — from competitive pricing — pricing and plans.
Get Started
Ready to move your business to Saudi cloud? View plans and pricing or contact us for a free consultation.
