Saudi PDPL readiness check

The Saudi PDPL — Royal Decree M/19 of 2021, amended by M/148 of 2023 — has been fully enforced since 14 September 2024, and SDAIA is enforcing it: 48 violation decisions in 2025, with fines up to SAR 5 million per violation, doubled for repeats. Mishandling sensitive data is the criminal tier — up to two years’ imprisonment and/or SAR 3 million. Registration on the National Data Governance Platform is mandatory for public entities, for controllers whose main activity is processing, and for anyone processing sensitive data. And the 2024 Transfer Regulations made SDAIA’s standard contractual clauses — unmodifiable — the default route abroad. Twelve questions tell you whether your house is in order.