PDPL Compliance for a Small Business Website in Saudi Arabia (2026)

Last checked: October 9, 2026. The Arabic text of the law is authoritative; SDAIA publishes English versions of the law, regulations, and guides on sdaia.gov.sa and the National Data Governance Platform.

Most PDPL guides online are written by consent banner vendors and compliance consultancies, and they read as if every website in the Kingdom needs a data protection officer and a registration certificate. Most small business websites do not. This page separates what the law actually requires of a typical small business site (a contact form, a booking page, a newsletter, a shop) from what applies only to larger or higher risk processing, and it says which rules are in force and which are still proposals.

The short version. If your site collects names, phone numbers, emails, or orders from people in Saudi Arabia, the PDPL applies, whether or not your company is in the Kingdom. You need a privacy notice in plain language, a lawful basis for each use (usually consent), a way to withdraw consent, consent before marketing messages, a process to answer data subject requests, and a plan to notify SDAIA within 72 hours of a breach. You probably do not need to register on the National Data Governance Platform or appoint a DPO unless you process sensitive data or data processing is your main business. Penalties run to SAR 5 million per violation, doubled for repeat offenders, and SDAIA had issued 48 enforcement decisions by January 2026.

The dates that matter

The Personal Data Protection Law was issued by Royal Decree M/19 in September 2021 and amended by M/148 in March 2023. It came into force on September 14, 2023, with a one year grace period that ended September 14, 2024. Since then it has been enforceable, and enforcement is real: Clyde & Co counted 48 enforcement decisions by mid January 2026, with proceedings run through an electronic platform where the business has five days to respond to a notification and 60 days to appeal.

In February 2026 SDAIA issued rules for licensing and accrediting the bodies that will issue PDPL accreditation certificates and run audits. A set of amendments to the Implementing Regulations went to public consultation in April and May 2025 (simpler privacy notices, a ten business day response window for SDAIA requests, DPO and registration rules folded into the regulations). As of our check those amendments had not been published as final. Do not act on them yet; do watch for them.

Does it apply to you if you are not in Saudi Arabia

Yes. The law applies to any entity, inside or outside the Kingdom, that processes personal data of individuals residing in Saudi Arabia. A US agency building a site for a Riyadh clinic owes PDPL compliance on the data it touches. So does a Dubai company selling to Saudi customers.

What a typical small business website needs

1. A privacy notice in plain language. SDAIA's privacy policy guideline expects you to say what you collect, how (forms, cookies, analytics), why, who you share it with, how long you keep it, how someone withdraws consent, and how they complain. Cookie data counts as personal data. There is no separate cookie law in the Kingdom, so a consent banner is not mandated as such, but consent is the main legal basis and you need to be able to show you have it.

2. A lawful basis for each processing purpose. For most small sites that is consent, collected at the point of the form or checkout, specific to the purpose, and withdrawable at any time. Sensitive data (health, biometric, credit, religion, and similar) requires explicit consent.

3. Marketing only with consent and an opt out. Direct marketing by email, SMS, or WhatsApp needs prior consent and a working unsubscribe. Reported enforcement activity has focused on marketing sent without a time stamped consent record, which is the easiest violation to prove and the easiest to prevent.

4. A way to handle data subject requests. Access, correction, deletion, and withdrawal of consent. For a small site this is an email address that someone actually reads and a written procedure.

5. Breach notification in 72 hours. The register rules require notifying SDAIA within 72 hours of becoming aware of an incident, through the National Data Governance Platform's breach service, and notifying affected individuals without undue delay. Decide now who does this and how you would know.

6. Cross border transfers handled. If your site is hosted on US or European infrastructure, or you use a US email or CRM tool, you are transferring personal data outside the Kingdom. The transfer regulation (updated September 2024) allows this to countries on an adequacy list, or with safeguards such as standard contractual clauses, binding common rules, or an accreditation certificate, plus a risk assessment. SDAIA had not published the adequacy list as of our check, so in practice small businesses rely on standard contractual clauses with their vendors. Ask every SaaS tool you use whether it offers them.

What you probably do not need

Registration on the National Data Governance Platform. The register rules name four triggers: you are a public entity; your main activity is based on processing personal data; you process sensitive data; or you process personal data for purposes beyond personal or family use in a way the authority specifies. A plumbing company's contact form does not meet these. A clinic's online booking does, because health data is sensitive. If you do register, the certificate is valid for up to five years and there is currently no fee.

A Data Protection Officer. Required when your core activities involve regular and systematic monitoring of individuals at scale, or processing sensitive data, or you are a public entity with large scale processing. Internal HR processing is not a core activity. A retailer or a trades business does not need one; a clinic, a lab, a lender, or an ad tech business likely does.

A records of processing register in a prescribed format. The proposed amendments would drop the minimum contents. Until they land, keep a simple record of what you process and why. It is also what you need to write the privacy notice.

Penalties

Disclosure of sensitive data with intent to harm or benefit: up to two years imprisonment and a fine up to SAR 3 million. Other violations: a warning or a fine up to SAR 5 million. The committee may double the fine for repeat offenders. These are per violation ceilings; most of the 48 decisions to date have not been at the ceiling, but the cost of a notification, a five day response window, and legal time is real for a small business either way.

A checklist you can hand to your web developer

1. Privacy notice page, linked from every form and the footer, covering the eight points above.
2. Consent checkbox on every form that feeds marketing, unticked by default, with the timestamp stored.
3. Unsubscribe link in every marketing message that actually works.
4. A data request mailbox and a one page procedure.
5. Vendor list: hosting, analytics, email, CRM, booking, payments, with transfer safeguards noted for each.
6. Breach plan: who detects, who decides, who files within 72 hours.
7. If you handle health, financial, or biometric data: registration on the platform and a named DPO.

What this costs

A compliant privacy notice, consent capture, and request procedure are a few days of work on a normal small business site. We include them in every site we build; web development starts at $6,000 with published typical ranges, and custom software that touches Saudi customer data is scoped with PDPL in the requirements from day one, not bolted on. For context on how Saudi and Gulf small business sites currently perform, our Gulf SMB website study audited 44 of them. If you are weighing how to pay for the work, our guide to small business funding in Saudi Arabia for digital projects lists what is open. If you are still deciding whether to commission software at all, read the build or buy decision for a small business.

This page is general information, not legal advice. For a specific situation, especially one involving sensitive data, use a Saudi licensed lawyer.

Frequently asked questions

Does a small business website in Saudi Arabia need to register with SDAIA?

Only if it meets one of the register rule triggers: processing sensitive data (health, biometric, credit, religion), having data processing as its main activity, being a public entity, or processing beyond personal use in a way the authority specifies. A typical contact form or shop does not. A clinic booking page does.

Does a small business need a Data Protection Officer under PDPL?

Only when core activities involve regular and systematic monitoring of individuals, or processing sensitive data, or large scale public sector processing. Most small retailers and service businesses do not; clinics, labs, lenders, and data businesses usually do.

Is a cookie banner required under the Saudi PDPL?

There is no cookie specific law. Cookie data is personal data, consent is the primary lawful basis, and your privacy notice must cover collection methods and withdrawal. A banner is the usual way to show consent for non essential cookies, but the requirement is the consent and the record, not the banner itself.

What is the PDPL breach notification deadline?

72 hours from becoming aware of the incident, to SDAIA through the National Data Governance Platform, and to affected individuals without undue delay.

What are the maximum PDPL fines?

Up to SAR 5 million per violation for general breaches, doubled for repeat offenders; up to SAR 3 million and two years imprisonment for disclosing sensitive data with intent to harm or benefit.

Sources

• SDAIA, Guide to the Saudi Personal Data Protection Law for controllers and processors, December 2023 (English, National Data Governance Platform).
• SDAIA, Rules Governing the National Register of Controllers within the Kingdom (registration triggers, Article 2; breach notification, Article 12; certificate validity, Article 10).
• SDAIA, Rules for Appointing a Personal Data Protection Officer, August 27, 2024.
• Saudi Press Agency, Regulation on Personal Data Transfer Outside the Kingdom updated, September 1, 2024; Rules Governing PDP Licensing and Accreditation, February 17, 2026; public consultation on amendments, April 29, 2025.
• Clyde & Co, Enforcement of the Saudi PDP Law, March 30, 2026 (48 decisions, five day response, 60 day appeal).
• DLA Piper, Data Protection Laws of the World, Saudi Arabia, updated February 11, 2026 (penalties, extraterritorial scope, cookies).
• CMS, New SDAIA rules and guidelines as KSA's framework becomes enforceable (transfer safeguards, adequacy list status).