Saudi PDPL enforcement: 48 SDAIA decisions, fines up to SAR 5M per breach.
Insight N°036
19 March 2026
The Saudi Personal Data Protection Law (PDPL) is now actively enforced. The Saudi Data and AI Authority (SDAIA), which administers the PDPL, has issued 48 enforcement decisions in the past 12 months. Maximum fines reach 5 million Saudi riyals per breach. Cross-border transfers of personal data continue to require Standard Contractual Clauses or Binding Corporate Rules under the PDPL Implementing Regulations, and no adequacy list has yet been published.
How GDPR muscle memory translates
For international firms with mature European Union General Data Protection Regulation (GDPR) compliance programmes, the substantive obligations under the Saudi PDPL are familiar in shape. Data subject rights, lawful basis requirements, processor obligations, breach notification, cross-border transfer mechanisms all map closely to GDPR. The translation is mechanically straightforward.
Where the translation breaks
Two specific areas require local adaptation. First, Saudi-specific Standard Contractual Clauses must be put in place between the Saudi entity and any foreign parent or processor (the European SCCs are not directly recognised). Second, SDAIA’s enforcement posture differs from European data protection authorities in that 48 decisions in 12 months represents a comparatively active enforcement programme. international firms should not assume European levels of enforcement leniency for early-stage compliance gaps.
What we do
audixintel helps international firms implement Saudi-specific PDPL compliance, including Saudi SCCs, Implementing Regulations review, and SDAIA enforcement posture mapping. From the policy framework through the operational compliance setup.
Sources
audixintel
Saudi market entry, made operational.