Saudi PDPL checklist for your website and app
If your website or app collects a name, a phone number or an order, you're processing personal data, and Saudi Arabia's Personal Data Protection Law (PDPL) most likely applies to you. The law has been fully enforceable since 14 September 2024. It's overseen by the Saudi Data and AI Authority (SDAIA), which announced 48 violation decisions during 2025.
This is a practical checklist for the technical side. It's general information, not legal advice.
1. Know what you collect
Write a simple table: what data, why you collect it, where it's kept, who can access it, and how long you keep it. Most problems show up here, like a form asking for a birth date for no reason, or old customer data forgotten in a spreadsheet.
2. Ask for less
Every field on a form needs a clear reason. Data you never collect is data you never have to protect.
3. A real privacy notice
Don't copy one from another site. It should be in Arabic and explain what you collect, for what purpose, your legal basis, who you share it with, how long you keep it, the user's rights and how to contact you.
4. Make consent clear
- Don't pre-tick the consent box.
- Keep marketing consent separate from service consent.
- Keep a record of who agreed, to what, and when.
- Make withdrawing consent easy.
5. Be ready for data requests
Customers have the right to ask to see, correct and destroy their data. Decide who receives these requests and how your system carries them out, before the first one arrives.
6. Technical protection
- HTTPS on every page.
- Hashed passwords and encrypted sensitive data.
- Access limited to what each person needs, not one shared login.
- Two-factor authentication on admin panels.
- Access logs and backups you've actually tested.
7. Watch third parties and hosting location
Analytics, chat and marketing tools often send data to servers outside the Kingdom. The law doesn't ban transfers abroad outright, but it sets conditions you need to check. Hosting inside the Kingdom saves much of that work and speeds up your site for customers here. Some government-related projects have stricter requirements.
Review your contracts with service providers too, because you remain responsible for data even when someone else processes it.
8. A plan for breaches
If a breach causes harm, you must notify SDAIA within 72 hours of becoming aware of it, and sometimes the people affected too. Prepare now: who decides, who notifies, and where the technical details are. 72 hours goes quickly if you start from nothing.
9. Retention and deletion
Set a period for each type of data, and delete what's no longer needed. Old data is risk without benefit.
What are the penalties?
Under the law, fines for violations can reach SAR 5 million and double for repeat offences, and disclosing sensitive data with intent to harm carries heavier penalties. In practice, though, your customers' trust matters most.
Where to start
Start with items 1 and 3, then consent, then the breach plan. I work on the technical side: reviewing systems, closing gaps, and building consent, requests and records. Legal opinions belong with your lawyer or data protection officer.
If you use an invoicing system, also read what e-invoicing requires.
Want to know where your site stands today? Get in touch and we'll start with a clear review.