Jurisdiction Guide
Saudi Arabia Privacy & Data Protection Laws
Every regime below can apply to a business handling Saudi Arabia residents' data, depending on whether you have an established presence there, actively offer goods or services to residents, or monitor their behavior. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
Applies to any processing of personal data within Saudi Arabia, and extraterritorially to any entity outside the Kingdom that processes personal data relating to Saudi residents — broader than GDPR's test, since it does not require the foreign processor to be actively 'targeting' or monitoring Saudi residents; mere processing of a Saudi resident's data by any means triggers applicability. Exempts processing by individuals for purely personal/family use where data isn't disclosed beyond that private circle; no confirmed general exemption for government agencies, nonprofits, or health/financial sectors beyond this.