Personal Data Protection Law

Applies to any processing of personal data within Saudi Arabia, and extraterritorially to any entity outside the Kingdom that processes personal data relating to Saudi residents — broader than GDPR's test, since it does not require the foreign processor to be actively 'targeting' or monitoring Saudi residents; mere processing of a Saudi resident's data by any means triggers applicability. Exempts processing by individuals for purely personal/family use where data isn't disclosed beyond that private circle; no confirmed general exemption for government agencies, nonprofits, or health/financial sectors beyond this. The Implementing Regulations and the separate Regulations on Personal Data Transfer Outside the Kingdom (both issued in 2023, with the transfer rules subsequently amended) supply the operative detail on lawful bases, records of processing, impact assessments, and the risk-assessment route for outbound transfers. SDAIA is the current regulator, with supervision expected to move to a dedicated authority.