Saudi Arabia’s Personal Data Protection Law (PDPL) went into active enforcement following the end of its compliance grace period in September 2024. Specialized committees have issued around 48 decisions confirming PDPL violations and imposing penalties, including warnings and fines of up to SAR 5 million per violation. Violations include processing data without a legal basis, failing to secure consent, and inadequate data safeguards. Organizations handling personal data in Saudi Arabia should reassess their compliance frameworks.
