What is PDPL Saudi ?
The Personal Data Protection Law (PDPL Saudi) is Saudi Arabia's personal data protection law, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). Effective since September 2023, it defines data subject rights, controller obligations, and international data transfer rules. The PDPL Saudi draws from the European GDPR while incorporating local specificities. It applies to any organization processing personal data of Saudi residents, regardless of establishment location.
Key Points
- Data subject rights: access, rectification, erasure, portability, and right to object to processing
- Legal basis for processing: explicit consent required except for limited exceptions (vital interest, legal obligation)
- International transfers: allowed only to countries providing adequate protection or with appropriate safeguards
- Mandatory data breach notification to the competent authority
- Penalties: fines up to 5 million SAR and imprisonment up to 2 years
Why Zaxyr
Zaxyr facilitates PDPL Saudi compliance with tools for processing register management, rights request tracking, and international transfer documentation. The platform provides native mapping to GDPR and NCA ECC, enabling organizations present in Saudi Arabia and Europe to manage their compliance in a unified way.