The PDPL Implementing Regulations: the obligations companies miss

The law, the regulations and the timeline

Saudi Arabia's Personal Data Protection Law (PDPL) was issued by Royal Decree No. M/19 of 9/2/1443H (16 September 2021) and amended by Royal Decree No. M/148 of 5/9/1444H (27 March 2023). It came into force on 14 September 2023, and organizations had one year to comply, so enforcement started on 14 September 2024. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulator.

Two regulations carry most of the operational detail:

• the Implementing Regulations of the PDPL, issued in September 2023;
• the Regulation on Personal Data Transfer outside the Kingdom, amended by SDAIA in 2024.

SDAIA has also issued guidelines on appointing a data protection officer, privacy policies, data destruction, anonymization and pseudonymization, and disclosure. If the law tells you what to protect, the regulations tell you how fast, how often and with what records.

Data subject requests: 30 days

The PDPL gives individuals the right to be informed, to access their data, to obtain a copy in a readable format, to have it corrected and to have it destroyed, and to withdraw consent.

The Implementing Regulations set the clock. You must respond within 30 days. You can extend once by a further 30 days where the request needs unexpected or unusual effort, or where the same person sends several requests.

What this means in practice:

• one intake channel per brand, with identity verification before any data is released;
• a request log that records receipt date, deadline, owner and outcome;
• a search procedure that covers every system holding personal data, including backups, CRM, support tools and vendors.

Requests managed through a shared mailbox are a common failure point. Deadlines slip and nobody can prove when a request arrived.

Records of processing activities

Controllers must keep a record of processing activities for as long as the processing continues and for five years after it ends. The record describes each processing activity, including its purpose, the categories of personal data and data subjects, the recipients, any transfer outside the Kingdom, the retention period, and the organizational, administrative and technical measures that protect the data.

Most organizations write this record once, for the compliance file, and never update it. Tie it to your change process instead: a new product, vendor or data flow is not live until the record reflects it.

When a DPIA is mandatory

A data protection impact assessment (DPIA) is required before processing that involves any of the following:

• sensitive data;
• collecting, comparing or linking two or more sets of personal data from different sources;
• large-scale, systematic processing of people who fully or partly lack legal capacity;
• continuous monitoring of data subjects;
• new technologies;
• decisions based entirely on automated processing;
• a product or service likely to cause serious harm to data subjects' privacy.

Under the PDPL, credit data counts as sensitive data, alongside health, biometric, genetic and location data, among others. A lender's credit decisioning, a fintech's automated onboarding and a fraud model that links device, location and transaction data each meet at least one trigger. Run the DPIA before launch, not after the first complaint.

Legitimate interest has conditions

The PDPL allows processing for the controller's legitimate interest, but the Implementing Regulations attach conditions. You must document a legitimate interest assessment that balances your interest against the data subject's rights and interests. It cannot be used to process sensitive data.

The common mistake is treating legitimate interest as a default basis for everything consent does not cover. Each use needs its own assessment on file.

Processors and sub-processors

Your contract with every processor must include the terms the regulations require, including the processor's duty to notify you of a breach without undue delay. Processors need your prior approval before engaging sub-processors, and must identify any other party that receives the data. You remain responsible for verifying that your processors comply.

For a typical fintech, this covers the cloud provider, identity verification vendor, messaging provider, support platform and analytics tools.

Direct marketing needs consent

Processing personal data for advertising or direct marketing requires the person's consent, and you must offer a simple way to opt out at any time. Bundled consent inside terms and conditions does not meet that standard. Keep marketing consent separate, recorded and withdrawable.

Breach notification: 72 hours

Notify SDAIA through the National Data Governance Platform within 72 hours of becoming aware of a breach that may cause harm to data subjects or conflict with their rights or interests, and notify affected individuals without undue delay. The clock starts when you become aware, not when the investigation ends.

The data protection officer

You must appoint a data protection officer (DPO) where you are a public entity providing services that involve large-scale processing, where your core activities involve regular and systematic monitoring of individuals, or where your core activities involve processing sensitive data. The DPO can be an employee or an external contractor.

Because credit data is sensitive, lenders, finance companies and credit-led fintechs should plan to appoint one.

Penalties

Disclosing or publishing sensitive data in breach of the law, with intent to harm or for personal benefit, carries up to two years' imprisonment, a fine of up to SAR 3 million, or both. Other violations carry a warning or a fine of up to SAR 5 million, and the fine can be doubled for repeat violations. Individuals can also claim compensation for material or moral damage.

A checklist for the regulations

Limaz builds PDPL programmes as operating systems, not document sets: data inventory, rights workflows, DPIAs, processor controls and technical measures. See our PDPL compliance service.