Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL)

Personal Data Protection (PDPL)

Saudi Arabia's data-protection regime: the PDPL, its Implementing Regulation, and the rules and guidelines beneath them.

23 instruments in this framework.

Primary law: niẓām (Royal Decree M/…)

Personal Data Protection Law (PDPL) · Royal Decree M/19 (9/2/1443H), amended by Royal Decree M/148 (5/9/1444H). In force 14 Sept

Implementing & executive regulation

Implementing Regulation of the Personal Data Protection Law · In force (September 2023 text). SDAIA published revised draft amendments on Istitlaa on 6
Draft Amendments to the Implementing Regulation of the PDPL (October 2026) (Draft) · Draft. Published on Istitlaa 6 October 2026; comments close 5 November 2026. In force 60 d
Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025) (Draft) · Withdrawn. Consultation closed 27 May 2025; not enacted; overtaken by the October 2026 dra
Regulation on Personal Data Transfer Outside KSA · Version 2.0 (cover dated August 2024; published September 2024). In force.

Rules, controls & standards

Rules Governing the National Register of Controllers within the Kingdom · In force; proposed for repeal (October 2026 draft).
Draft Requirements for Practising Personal Data Protection Activities (April 2025) (Draft) · Draft. Consultation opened April 2025 and closed May 2025; no final text as of 20 October
Rules for Appointing a Personal Data Protection Officer · Version 1.0, August 2024. In force; proposed for repeal (October 2026 draft).
Standard Contractual Clauses (SCCs) · Version 1.0, September 2024.
Guidelines for Binding Common Rules (BCR) for Personal Data Transfer · Version 1.0, September 2024.
Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors · Issue 1.0 (2026). Published in Umm Al-Qura on 6 March 2026; in effect on publication.
Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities · Version 1.0 (2026). In force; published in Umm Al-Qura on 6 March 2026.
Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations · Version 1. In force.

Guidelines & circulars

Draft standards guides for PDPL certification and audit providers (Draft) · Draft. Posted on Istitlaa about 7 July 2026; closing date unconfirmed; no final versions a
Privacy Policy (Notice) Guideline · Version 1.0, August 2024.
Destruction, Anonymisation and Pseudonymisation Guideline · Version 1.0, August 2024.
Personal Data Disclosure Cases Guideline · Version 1.0, August 2024.
Records of Processing (RoPA) Guideline · Version 1.0, August 2024.
Personal Data Breach Incidents Procedural Guide · Issue 1.0, October 2024.
Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom · February 2025. Non-binding.
Self-Assessment Guideline (incl. DPO-need tool) · Tool at dgp.sdaia.gov.sa
Minimum Personal Data Determination Guideline · Version 1.0, August 2024.
Guide to the PDPL for Controllers and Processors · December 2023

Related instruments

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21