Wadira — Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL)

Personal Data Protection (PDPL)

Saudi Arabia's data-protection regime — the PDPL, its Implementing Regulation, and the rules and guidelines beneath them.

19 instruments in this framework.

Primary law — niẓām (Royal Decree, M/…)

• Personal Data Protection Law (PDPL) — M/19 (2021), amended M/148 (2023); in force 14 Sep 2023

Implementing & executive regulation

• Implementing (Executive) Regulation — Amendments pending — consultation closed 27 May 2025; not enacted as of Jun 2026
• Regulation on Personal Data Transfer Outside KSA — Updated 2024

Rules, controls & standards

• Rules for Appointing a DPO
• Rules Governing the National Register of Controllers
• Standard Contractual Clauses (SCCs)
• Binding Common Rules (BCRs)
• Rules for Auditing & Inspecting Controllers and Processors
• Rules Governing Issuance of Accreditation Certificates
• Committee Working Rules

Guidelines & circulars

• Privacy Policy (Notice) Guideline
• Destruction / Anonymisation / Pseudonymisation Guideline
• Personal Data Disclosure Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Transfer to Non-Adequate Country Guideline
• Self-Assessment Guideline (incl. DPO-need tool) — Tool at dgp.sdaia.gov.sa
• Minimum Personal Data Guideline
• Guide to the PDPL for Controllers and Processors — December 2023

Related instruments

• Data Cybersecurity Controls
• Essential Cybersecurity Controls (ECC-2:2024)
• Anti-Cyber Crime Law
• Cloud Cybersecurity Controls (CCC-2:2024)

---

Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27