Wadira — Find your way through Saudi data & privacy law.
Home › Guide › PDPL enforcement & penalties — fines, committees and decisions
Saudi Arabia's PDPL is enforced by SDAIA. Specialised committees formed under Article 36 investigate violations and impose administrative penalties — a warning or a fine of up to SAR 5 million, doubled for repeat violations — appealable before the competent court. One criminal offence remains: disclosing or publishing sensitive data to harm the data subject or for personal gain (up to two years' imprisonment and/or SAR 3 million), prosecuted by the Public Prosecution. SDAIA reported 48 confirmed violation decisions in January 2026, with further fines and warnings announced in June 2026.
| Violation | Legal basis | Maximum penalty | Notes |
|---|---|---|---|
| Disclosure or publication of sensitive data with intent to harm the data subject or for personal benefit | PDPL Art. 35(1) | Imprisonment up to 2 years and/or fine up to SAR 3,000,000 | Criminal. Public Prosecution investigates and prosecutes; the court may double the fine for recidivism, up to SAR 6,000,000 |
| Any other violation of the PDPL or its regulations (processing without legal basis, unlawful disclosure, inadequate security, marketing without consent, breach-notification or DPO failures…) | PDPL Art. 36(1) | Warning, or fine up to SAR 5,000,000 | Administrative. Imposed by SDAIA committees; doubled for repeat violations, up to SAR 10,000,000 |
| Unlawful cross-border transfer *(historical)* | Former Art. 35 (2021 text) | Was: up to 1 year and/or SAR 1,000,000 | Repealed by the March 2023 amendments (M/148); transfer violations are now administrative under Art. 36 |
| Confiscation of funds gained from a violation | Art. 38(1) | Confiscation (no cap) | Ordered by the competent court |
| Publication of the decision summary | Art. 38(2) | Publication at the violator's expense | Court or committee may order it once the decision is final |
| Violations by public-entity employees | Art. 39 | Disciplinary sanctions | Under civil-service rules, without prejudice to Arts. 35–36 |
| Damage to individuals | Art. 40 | Compensation proportionate to material or moral damage (no cap) | Civil claim before the competent court |
In mid-January 2026, the Saudi Press Agency reported that the Committees for Reviewing Violations of the PDPL, operating under SDAIA, had issued 48 decisions confirming violations and imposing penalties on data controllers during the preceding year (SPA). SDAIA cited four violation categories: collecting and processing personal data without legal justification; disclosing personal data without legal basis; failing to implement appropriate organisational, administrative and technical protection measures; and sending advertising or marketing messages without data subjects' consent. No fine amounts, entity names or per-category counts were disclosed. IAPP's analysis additionally reported affected sectors including retail, telecommunications and financial services. Law-firm alerts (A&O Shearman, Clyde & Co, Latham & Watkins) characterise this as the first substantive adjudication wave since full enforceability on 14 September 2024.
On 29 June 2026, Saudi outlets reported a further package of committee decisions — varying fines and warnings — for direct marketing without explicit consent and failure to maintain measures enabling timely responses to data-subject requests; press reports also cited 72-hour breach-notification failures and failures to appoint required data protection officers. Again, no names or amounts were published.
Administrative enforcement runs through one or more committees formed by decision of SDAIA's President (Art. 36(2)): at least three members, including a technical specialist and a legal advisor, with powers to summon parties and take testimony in person, in writing or by videoconference. Committee decisions take effect on approval by SDAIA's President or their delegate and are appealable before the competent court. Separately, Article 37 inspectors may seek criminal-investigation assistance and seize the tools used in violations, and the Public Prosecution investigates and prosecutes the Article 35 sensitive-data offence.
What is the maximum fine under the Saudi PDPL?
For administrative violations, SDAIA's committees may issue a warning or a fine of up to SAR 5 million per violation (Art. 36), doubled for repeat violations up to SAR 10 million. The criminal offence of unlawfully disclosing sensitive data carries up to SAR 3 million (doubled up to SAR 6 million for recidivism) and/or two years' imprisonment (Art. 35). Civil compensation under Art. 40 is uncapped.
Has SDAIA actually penalised anyone yet?
Yes. SPA reported in January 2026 that SDAIA's committees issued 48 decisions during the prior year confirming violations and imposing penalties on data controllers, and a further set of fines and warnings was announced on 29 June 2026. SDAIA has not published violator names or individual fine amounts — announcements have been aggregate only, though Art. 38(2) permits publication of final decisions.
Can a PDPL violation lead to imprisonment?
Only one PDPL offence is criminal: disclosing or publishing sensitive personal data in violation of the law with intent to harm the data subject or achieve personal benefit — up to two years' imprisonment and/or SAR 3 million (Art. 35). The original 2021 law also criminalised unlawful cross-border transfers, but the 2023 amendments removed that offence.
What were the most common violations?
Per SDAIA's announcement: processing personal data without legal justification, disclosing personal data without legal basis, failing to implement required protection measures, and sending marketing messages without consent. The June 2026 wave added failures to respond to data-subject requests on time, late breach notifications and failures to appoint a required DPO.
*Content last verified: 14 July 2026. Aggregate figures come from official SPA/SDAIA announcements; sector detail and procedural specifics come from the cited analyses. No individual fine amounts or violator names have been officially disclosed — treat any circulating specific figures as unsourced. Reference material only — not legal advice.*
Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27