Saudi PDPL and Customer Data: Transfers, Consent, Marketing Communications

The Saudi Personal Data Protection Law (PDPL) applies across sectors to personal data processed in the Kingdom and, in some cases, beyond it, and it has been fully enforceable since 14 September 2024 910. For a customer data platform (CDP), four rules matter most: purpose-specific consent, a simple opt-out from direct marketing, 72-hour breach notification, and SDAIA-approved safeguards for any transfer abroad. Fines reach SAR 5 million and double for repeat violations 911.

Who this is for: DPOs, CISOs and marketing-operations leads who hold customer data of people in Saudi Arabia, and architects deciding where a CDP should run. You get the obligations, transfer mechanisms, sector overlays, a PDPL vs GDPR table and a checklist. Part of the regulation hub.

Saudi PDPL and Implementing Regulations: scope and who enforces

Use the PDPL, Implementing Regulations, Transfer Regulation and relevant sector instruments as a set. The supplied fact check cites DLA Piper’s Saudi guide updated 11 February 2026, but the SDAIA host rejected the official text during this refresh. Current amendment dates and operative wording therefore remain unavailable here. Do not mistake the separate October 2026 consultation for an enacted change. SDAIA source.

Personal data is anything that identifies a person directly or indirectly. Sensitive categories include ethnic or tribal origin, religious, intellectual or political beliefs, criminal and security data, biometric, genetic, credit, health and location data 9. Marketing teams collect the last two without noticing: app location and health-related browsing or purchase signals.

Consent, legitimate interest and automated decisions

For a CDP, assume consent, record it per purpose, and treat sensitive signals and solely automated decisions as explicit-consent territory 11. The consent withdrawal and suppression architecture article shows how a withdrawal reaches every channel.

Direct marketing and consent under the PDPL

For marketing, document the applicable legal basis, channel, notice, withdrawal path and suppression behavior. Clyde & Co’s October 2026 commentary describes proposed changes to marketing requirements; it does not establish that the proposal is already law. The exact current opt-out article number and CST interaction were not confirmed from official text. Clyde & Co, secondary.

Two practices hold either way:

• Separate consent. Ask for marketing consent on its own, not inside service terms, because consent is separate per purpose and cannot be a condition of service unless directly related 11.
• One-step opt-out, honoured everywhere. Make opting out as easy as opting in, and apply it across email, SMS, push and ad-audience exports from the same profile.

Banks face another layer: the Saudi Central Bank (SAMA) Rulebook lists rules for advertising products and services provided by financial institutions 6.

Transferring customer data outside Saudi Arabia

The Law (Article 29) allows transfers only for listed purposes and under conditions, and the Transfer Regulation supplies the mechanics 10. Each transfer must avoid prejudice to national security or vital interests, rest on adequate protection or an appropriate safeguard, and be limited to the minimum necessary data (the safeguard route drops the separate minimum-necessity test, though general minimisation still applies) 10.

A documented risk assessment is required before a safeguard-based transfer, and when sensitive data moves out on a continuous or large-scale basis; SDAIA's February 2025 guideline sets a four-phase method 10. The Transfer Regulation was first published on 7 September 2023 and replaced on 1 September 2024 10.

Is there data localisation? Not as a general rule: the Law restricts transfers rather than mandating in-Kingdom storage 9. Localisation pressure comes from sector rules. See data residency requirements by country and residency vs sovereignty vs jurisdiction.

Sector overlays: banking, cloud, telecom and health

If you are a bank, insurer, hospital group or their processor, treat the sector rule as the binding constraint and the PDPL as the floor.

Penalties and SDAIA enforcement to date

Saudi PDPL vs GDPR

The structure is close enough that a GDPR programme is a good start, but SDAIA's SCC forms, the accreditation route, platform registration and sector layers need separate work. For the EU side, see GDPR transfers after Latombe.

What this means for a customer data platform

• Consent records. Store consent per purpose with timestamp, channel, notice version and withdrawal state, and let segmentation read it at query time. A profile without a valid purpose should not be activatable.
• Residency choice. Hosting in the Kingdom removes the transfer analysis for the core profile store; hosting abroad needs an SCC, BCR or accreditation route plus a risk assessment 10. A SaaS platform with SCCs can suit non-sensitive marketing data; regulated sectors usually need more. Customer-owned deployment keeps the choice with you, see on-premise, private cloud and self-hosted customer data platforms.
• Vendor due diligence. For every processor and sub-processor, record location, SCC status, whether it can meet a 72-hour breach clock, and alignment with NCA controls where they apply 23.
• Rights at scale. A 30-day clock needs identity resolution that finds every record, and erasure that reaches processors and backups.

PrivyCDP is a customer-owned platform that runs on-premise or in your own cloud account; it addresses residency and key control, not consent or notice duties, which remain yours. See deployment and the compliance guide.

Saudi PDPL compliance checklist

• Map customer-data flows; tag Saudi data subjects and sensitive categories.
• Register on the National Data Governance Platform if required, and appoint a DPO if a trigger applies 11.
• Rebuild consent per purpose, with separate marketing consent and retained evidence 11.
• Add explicit consent for sensitive data, credit data and solely automated decisions 11.
• Provide a one-step marketing opt-out across all channels 11.
• Run a 30-day request workflow with a request log 11.
• Write a 72-hour breach runbook that reaches SDAIA through the platform 911.
• List every transfer and choose SCCs, BCRs, accreditation or an exception 10.
• File the pre-transfer risk assessment, and re-paper processors on SDAIA's unmodified SCC forms 10.
• Check SAMA, NCA and CST requirements before choosing hosting 25.
• Track amendments and the adequacy list on the deadline tracker.

If your customer data platform must keep Saudi customer data in a region, account or data centre you control, a deployment qualification call scopes on-premise, private-cloud or hybrid options against these controls. Related: UAE PDPL and health data localisation, and more playbooks in the regulation hub.

October 2026 proposal: source status

Clyde & Co, 8 October 2026, reports consultation from 6 October to 5 November 2026 on amendments including express localisation duties. This is secondary commentary about a proposal. The SDAIA host rejected retrieval of the official text, so this guide does not treat the draft as an enacted new storage obligation.