Saudi Arabia PDPL becomes fully enforceable; SDAIA Data Transfer Regulation and SCCs

Mechanism

The PDPL applies to any processing of personal data of Saudi residents regardless of where the controller or processor is located, giving it explicit extraterritorial reach. Core obligations crystallised at the end of the one-year grace period on 14 September 2024:

• DPO appointment — required for entities whose core activities

involve regular and systematic monitoring of large-scale personal data, processing of sensitive data, or that act as public-sector controllers.

• Breach notification — controllers must notify SDAIA within 72

hours of becoming aware of a personal-data breach that may cause harm to data, individuals, or violate their rights/interests; data subjects must be notified without undue delay where harm is likely.

• Cross-border transfers — exports of personal data outside the

Kingdom require compliance with the SDAIA Data Transfer Regulation (Regulations on Personal Data Transfers outside KSA), which permits transfers under (i) an adequacy assessment of the destination, (ii) SDAIA-prescribed SCCs, (iii) binding common rules for intra-group transfers, or (iv) explicit consent / narrow public-interest derogations. SDAIA published four SCC templates in 2024 covering the C2C, C2P, P2P, and P2C transfer patterns.

• Register / records / DPIA — record-of-processing-activities

duty for controllers, and DPIAs required for high-risk processing including sensitive data, automated decision-making, or large-scale monitoring.

Downstream implications

• Cloud and financial services — Western hyperscalers and global

banks operating Vision-2030-linked workloads must execute SDAIA SCCs (or qualify for adequacy / BCR routes) before continuing outbound personal-data flows; intra-group HR and customer-data pipelines re-papered through 2024-2025.

• Healthcare and life sciences — sensitive-data processing

thresholds for DPO and DPIA bite first for clinical trials, insurance, and digital-health platforms scaling under Saudi Vision-2030 health-sector reforms.

• Regional alignment — KSA joins UAE (Federal Decree-Law 45/2021)

and broader GCC trend toward GDPR-adjacent baseline; meaningful divergence remains on consent, localisation triggers, and the SCC catalogue specifics.

• Enforcement risk — SDAIA enforcement actions from September

2024 onwards establish the precedent set for fines (up to SAR 5m per violation, doubling for repeats, plus criminal exposure for unlawful transfers of sensitive data abroad).

Open questions

• Pace of SDAIA enforcement actions in the first 12 months post-grace

and whether the regulator front-loads guidance over fines.

• Whether SDAIA issues adequacy decisions for major partner

jurisdictions (UK, EEA, Singapore) that would reduce the SCC papering burden.

• Interaction with sector-specific data rules (SAMA cybersecurity

framework, NCA Essential Cybersecurity Controls) where overlap with PDPL data-handling duties creates a compound compliance perimeter.