Saudi Arabia's Personal Data Protection Law and your company website

A quote request form, a customer account in the shop, a mailing list, a job application form. Everything your website collects about people in the Kingdom falls under the Personal Data Protection Law (PDPL). The law is not addressed only to the developer or the hosting company. It is addressed to your company as the "controller", the party that decides why data is collected and how it is processed.

This article explains what the law means in practice for a company website, with article numbers for anyone who wants to check the text. It is for information and is not legal advice: for specific cases, ask a lawyer or your data protection officer.

The law in brief

The Personal Data Protection Law was issued by Royal Decree No. (M/19) of 9/2/1443 AH and amended by Royal Decree No. (M/148) of 5/9/1444 AH. It came into force on 14 September 2023, with a one-year grace period that ended on 14 September 2024. Two regulations complete it: the Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom.

The authority that supervises it is the Saudi Data and Artificial Intelligence Authority (SDAIA), which runs the National Data Governance Platform. The platform's services include notifying personal data breaches and receiving complaints. SDAIA publishes its guides and rules on the regulations and policies page of its website (in Arabic).

Article 2 says the law applies to any processing of personal data relating to individuals that takes place in the Kingdom by any means, including processing of the data of residents of the Kingdom by any party outside it. If your company is in Dubai and sells through its website to customers in Riyadh or Jeddah, the law may cover you too.

What a visitor must know before sending their data

Article 12 requires the controller to adopt a privacy policy and make it available to data subjects before collecting their data. The policy states the purpose of collection, which data is collected, how it is collected, processed, stored and destroyed, and what rights the data subject has and how to exercise them.

When you collect data directly from the person, as in a form on your website, Article 13 requires you to inform them at the time of collection of, among other things:

• the legal basis for collecting their data and the purpose of collection,
• which fields in the form are mandatory and which are optional,
• the identity of whoever collects the data,
• the parties the data may be disclosed to, and whether it will be transferred or processed outside the Kingdom,
• their rights under the law.

In practice that means a clear link to a privacy policy in Arabic next to every form, optional fields marked as optional, and not asking for anything you do not need. Data minimisation is one of the principles SDAIA sets out in its explanation of the law: collect only what the purpose requires. If you are writing a privacy policy for the first time, SDAIA has published a guide to preparing and developing a privacy policy that lists the elements expected in it.

Marketing messages need prior consent

Article 25 prohibits using a data subject's personal means of contact, including postal address and e-mail, to send advertising or awareness material, except under two conditions: the recipient's prior consent, and a clear mechanism that lets them ask to stop receiving it. Article 26 allows processing data for marketing purposes, except sensitive data, if it was collected directly from the data subject and with their consent.

What this means for your website:

1. A separate consent checkbox for marketing messages, not ticked in advance and not bundled with sending the quote request.
2. An unsubscribe link that works in every message, and unsubscribe requests that are actually carried out.
3. A record showing when each person consented and to what.
4. No bought lists or lists copied from other sources in your campaigns, because the law requires marketing data to be collected directly from the person.

Data security on the website itself

Article 19 requires the controller to take the necessary organisational, administrative and technical measures and means to protect personal data, including when it is transferred. Article 23 of the Implementing Regulation adds compliance with the controls and standards of the National Cybersecurity Authority, or with recognised cybersecurity best practices and standards if the organisation is not bound by the Authority's controls.

The law does not name plugins or certificates, but on a company website these articles mean concrete things:

• every page with a form runs over HTTPS with a valid certificate,
• the core, theme and plugins are up to date, and abandoned ones are deleted (see outdated WordPress plugins),
• two-step verification for the site's admin panel, the hosting panel and e-mail,
• security headers that, for example, stop your pages from being embedded in other sites (you can check them with the free security headers check),
• old form messages are destroyed once their purpose has ended, because SDAIA requires personal data to be destroyed without delay after the purpose of collection has ended.

A question many people miss: where is the form data stored? If your hosting, your form tool or your CRM runs on servers outside the Kingdom, that is a transfer of data abroad, and the Regulation on Personal Data Transfer outside the Kingdom sets conditions for it. Ask your providers where their servers are, and show the answer to your legal adviser.

A leak: notifying SDAIA within 72 hours

Article 20 of the law requires the controller to notify the competent authority as soon as it learns of any leak or damage to personal data or unlawful access to it, and to notify the data subject if this could harm their data or affect their rights and interests. Article 24 of the Implementing Regulation sets the deadline: 72 hours from becoming aware of the incident, if it could harm the data or the data subjects or conflict with their rights and interests.

The notification includes a description of the incident, when and how it happened and when you learned of it, the categories of data and the actual or approximate number of people affected, the risks and the measures taken, and contact details. If not all the information is available within 72 hours, it is submitted as soon as possible with the reasons for the delay. Data subjects are notified without undue delay, in plain and clear language, with advice that helps them protect themselves.

72 hours is short if you are not prepared. Decide in advance who in your company files the notification through the National Data Governance Platform, where to find the server logs, and whom to call at your agency and your hosting company.

Registration, data protection officer and penalties

SDAIA has issued rules governing the national register of controllers within the Kingdom. Registration on the platform is required in cases that include: the organisation is a public entity, its main activity is based on processing personal data, or it processes sensitive data, such as health data on a clinic's website.

Article 32 of the Implementing Regulation requires a data protection officer to be appointed in specific cases, including when the organisation's core activities require regular and continuous monitoring of individuals on a large scale, or when its core activities are based on processing sensitive data. Article 33 requires it to keep a written record of processing activities for the whole period of processing and for five years after it ends.

The penalties are set out in the law itself. Article 35: imprisonment of up to two years, a fine of up to three million riyals, or both, for anyone who discloses or publishes sensitive data in breach of the law with intent to harm the data subject or for personal gain. Article 36: a warning or a fine of up to five million riyals for any other breach of the law or its regulations, which may be doubled for repeat offences.

The figures are large, but most of what the law asks of an ordinary company website comes down to reasonable working habits: collect less, explain clearly, protect what you collect, and know what to do if something leaks. If your company also operates in the UAE, see the UAE Personal Data Protection Law.