Saudi Arabia's Personal Data Protection Law has been enforceable since 14 September 2024, and by early 2026 SDAIA had issued roughly 48 enforcement decisions. Unlike several regimes in the region, this one has a track record — and the pattern in it is consistent enough to plan against.
What the penalties are
| Provision | What it covers | Maximum |
|---|---|---|
| Article 35 | Disclosing sensitive personal data unlawfully, with intent to harm or for personal benefit | 2 years' imprisonment + SAR 3M |
| Article 36 | Other violations of the law and its regulations | SAR 5M |
| Article 36 (repeat) | Repeat offence | Maximum may be doubled |
| Breach notification | Notifying SDAIA of a breach that risks data or data subjects | within 72 hours |
Two things distinguish this from the UAE picture. First, the amounts are in the law itself, not delegated — so they can be quoted without hedging. Second, criminal liability attaches to individuals, not just the entity.
What the enforcement decisions have in common
Across the decisions issued so far, four causes recur:
| Recurring cause | How it shows up on a website | Visible from outside? |
|---|---|---|
| No valid lawful basis | Data collected for one purpose, used for another; consent bundled into one checkbox | Yes |
| Unauthorised disclosure | Records reachable by changing an identifier; data shared with third-party tools without basis | Yes |
| Inadequate safeguards | Injection points, exposed admin panels, outdated components, forms without TLS | Yes |
| Marketing without consent | Pre-ticked boxes, no working unsubscribe, data reused from an unrelated purpose | Yes |
That is the uncomfortable part. A regulator, a competitor or a disgruntled customer can establish most of these from the public side of your website. You do not get to find out first.
Consent is the default, and that changes the design
The Saudi law leans on consent as the default lawful basis more heavily than regimes built around legitimate interest. Practically, for a website:
- Separate purposes, separate consent. Fulfilling an order, sending marketing and running analytics are three purposes. One checkbox covering all three is the single most common design failure.
- Withdrawal has to work. If subscribing takes one click and unsubscribing takes an email to support, that is a finding waiting to happen.
- Sensitive data raises the stakes. Health, biometrics, religious or ethnic data pull you into Article 35 territory, where the exposure is criminal as well as financial.
Cross-border transfers
Transfers outside the Kingdom carry their own conditions, and this is where SaaS-heavy stacks quietly fall out of compliance. Your CRM, your analytics, your support desk, your email provider and your hosting may all sit elsewhere. Each is a transfer, and each needs a basis you can point to. The failure mode is not refusal — it is never having documented it.
The 72-hour clock
Notification to SDAIA is due within 72 hours of becoming aware of a breach that poses risk. Three practical consequences:
- "Becoming aware" starts the clock, so record the moment of discovery deliberately. Teams that cannot say when they found out argue from a weak position.
- You cannot notify accurately without logs. Retention long enough to reconstruct what was reached is not an operational nicety; it determines whether your report is fact or guesswork.
- Preserve before you remediate. Wiping the server destroys the evidence that establishes scope, and you still have to explain the incident afterwards.
What to fix on the website itself
Checklist
- Confirm you are in scope: any personal data of individuals residing in Saudi Arabia.
- Map each form and each purpose to a lawful basis; unbundle marketing consent.
- Make withdrawal of consent as easy as granting it, and test the path end to end.
- Inventory every transfer outside the Kingdom and record the basis for each.
- Identify sensitive data you hold — health, biometrics, and similar — and restrict access to it separately.
- Test the site externally for injection, broken access to other users' records, exposed admin interfaces and backups, outdated components.
- Check which trackers fire before consent.
- Name the person who notifies SDAIA, and draft the notification template in advance.
- Enable logging with retention sufficient to investigate within 72 hours.
- Re-test after fixes, and put the technical check on a schedule.