Saudi Arabia
Tier 2 Comprehensive law Middle EastPrincipal framework: PDPL (amended 2023) (2021). Regulator: SDAIA. The PDPL became fully enforceable in September 2024 after its grace period; 2024 transfer regulations added adequacy, contractual-clause and BCR routes.
At a glance
- Principal law
- PDPL (amended 2023)
- Regulator
- SDAIA
- Breach notification
- 72 hours to SDAIA; affected persons without undue delay where harm
- Maximum penalty
- Fines to SAR 5m (doubled on repeat); criminal penalty for sensitive-data disclosure
- DPO required
- Required in specified cases (public bodies, core large-scale processing)
- Digital consent age
- Parental consent for minors
- Extraterritorial reach
- Yes — processing of residents’ data from abroad
Structure
- Structural pattern
- Not assessed
- Sub-jurisdictions
- None — no sub-national axis
- ISO code
- SA
A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.
Transfers and adequacy
- EU member
- No
- EEA member
- No
Instruments
No instrument profiled yet.
Sources
- Regulator SDAIA — regulator and PDPL
Never independently verified — seeded from the prototype.