Web security and PDPL without the fluff

Most PDPL articles online quote confident fine amounts. The decree itself does not set them — penalties are defined by Cabinet resolution, and vendor blogs disagree with each other by an order of magnitude. Here is what the law does say, and what your website has to do about it.

Saudi Arabia moved from grace period to enforcement in September 2024, and by early 2026 SDAIA had issued roughly 48 decisions. The recurring causes are boringly consistent: no lawful basis, unauthorised disclosure, inadequate safeguards, marketing without consent.

A manual VAPT engagement in the GCC costs several times an automated audit and finds things no scanner will. It also happens once a year, while your code ships weekly. The honest answer is that they solve different problems — here is which one to buy first.