KSA PDPL
with ComplyEncrypt
The Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia, issued by Royal Decree M/19 and amended by Royal Decree M/148, came into force on 14 September 2023, with a one-year grace period that ended in September 2024. It is supervised by the Saudi Data & AI Authority (SDAIA) and is supported by Implementing Regulations and Regulations on personal data transfer outside the Kingdom.
Not available to buy yet. Planned price $2,500, or $1,000 for early sign-ups.
Who this is for
Organizations processing personal data in Saudi Arabia, or the personal data of people residing there
Companies serving Saudi customers, from SaaS providers to service exporters, increasingly face PDPL questions in due diligence. Without a clear record of what personal data is collected, why, where it is transferred and how rights requests and breaches are handled, answering those questions becomes guesswork.
The requirements
What KSA PDPL asks of your organization
Lawful processing and transparency
Process personal data for a specific, clear purpose with a valid legal basis such as consent, keep collection to what is necessary and publish a privacy policy.
Data subject rights
Respond to requests to be informed, to access and obtain a copy of personal data, to correct it and to have it destroyed when no longer needed.
Security, breaches and transfers
Apply appropriate safeguards, keep records of processing, notify SDAIA of qualifying breaches within 72 hours and transfer data outside the Kingdom only under the conditions the Transfer Regulations allow.
The planned ComplyEncrypt pathway
A structured approach to saudi arabia personal data protection
The planned ComplyEncrypt PDPL pathway is intended to provide guided privacy documentation, records of processing, data subject request and breach-notification workflows, and cross-border transfer assessments, reusing work already done for GDPR where the requirements overlap. It is on the roadmap and not available to buy yet; express interest to secure the early sign-up price.
Intended documentation scope
- Records of processing activities
- Privacy policy and consent records
- Data subject request and breach logs
- Cross-border transfer assessments
Your team remains accountable
The roadmap describes intended functionality, not a currently available module. Documents must reflect your real processes. Your team implements controls, verifies evidence and manages ongoing obligations.
The PDPL is a Saudi law. Software does not establish legal compliance; confirm how it applies to your organization with SDAIA guidance or qualified legal advisers.
On the roadmap
Interested in buying KSA PDPL?
Early sign-up price for the first customers
Tell us about your organization and purchase interest. This is an enquiry, not an order, payment or reservation.
Related frameworks
See the product in action.
A 2-minute walkthrough of what you get the moment you buy a framework.