Saudi Arabia PDPL
compliance
Saudi Arabia's PDPL, fully enforced since September 2024, is the Kingdom's first comprehensive data-protection law. Consent is the default legal basis, and cross-border transfer rules are strict.
Trusted by 2,000+clients worldwide
PDPL at a glance
Enforced
In force since September 2023; enforcement grace period ended September 2024.
Regulator
SDAIA (Saudi Data & AI Authority).
Penalties up to
SAR 5 million in fines, doubled for repeat violations, plus criminal penalties for sensitive-data breaches.
Consent standard
Consent is the default basis for processing; it must be freely given and revocable.
This guide is general information for site owners, not legal advice. Check the current text of the law and your own counsel for your situation.
What the law requires on your website
Consent by default
Unless another legal basis applies, processing personal data (including tracking identifiers) rests on consent; legitimate interest has been available for non-sensitive data since the 2023 amendment.
Privacy notice
Data subjects must be informed of purposes, collection methods and their rights at collection.
Transfer controls
Cross-border transfers require appropriate safeguards under SDAIA's rules, which is relevant to global ad and analytics stacks.
How Clickio Consent helps
Serve visitors from Saudi Arabia a consent flow configured for the PDPL: a localized dialog, granular purposes, equal-weight decline and stored records.
One tag, per-region rules
Clickio detects each visitor's location and serves the consent experience you configure for that region, this law included, without affecting any other market.
Multi-regulation →Localized dialogs
Language auto-detection and full text customization put the dialog in your visitors' language, with granular purpose choices and equal-weight decline.
Customization →Evidence on file
Every choice is stored as a consent record: the demonstrable-consent trail modern laws place on the controller.
Reporting →Frequently asked questions
Does the PDPL require cookie consent?
The PDPL's consent-by-default architecture means tracking that processes personal data needs consent unless another basis clearly applies. A consent dialog is the practical implementation.
Who enforces the PDPL?
SDAIA supervises enforcement, with fines up to SAR 5 million (doubled on repeat) and criminal exposure for sensitive-data violations.
Does it apply to companies outside Saudi Arabia?
Yes. The PDPL covers processing of Saudi residents' data by entities abroad.
Arabic or English dialog?
Clickio auto-detects language; Saudi visitors can see Arabic by default with English available, so consent is informed in the language visitors actually read.
How does this fit a global setup?
As one region among many: Clickio detects Saudi visitors and serves the PDPL flow, while the EU, UK, US and other regions keep their own frameworks from the same tag.
Explore other regulations
Every guide shows how the same Clickio tag serves the right consent experience for that market. Pick the next one that applies to your audience.
Add this market to your consent setup. Start with a 14-day free trial; per-region settings and multi-language dialogs start on Starter.
Per-region settings (own texts, choices and fallback) and multi-language dialogs start on the Starter plan.