Saudi Arabia’s data protection regime has entered a new phase.
The Saudi Data and Artificial Intelligence Authority (SDAIA) confirmed that 48 enforcement decisions were issued over the past year under the PDPL — marking the first substantive wave of adjudications since the transition period ended in September 2024.
Violations Included
• Unauthorised data processing
• Weak security controls
• Marketing without valid consent
Fines can reach SAR 5 million (~USD 1.3m), with higher exposure for repeat or sensitive-data breaches.
Bottom line: PDPL compliance is no longer theoretical. Implementation, governance, and demonstrable controls are now under regulatory scrutiny.
At S8fe.ai，we help organisations operationalise PDPL compliance — from lawful basis mapping and consent design to governance frameworks and technical control assessments.
If your business processes Saudi personal data, now is the time to stress-test your programme.
Source: https://www.securelink.sa/blogs/saudi-personal-data-protection-law-compliance-guide-2026/