The Saudi Personal Data Protection Law applies to almost every website that collects a name and an email address. Most Saudi business sites are not compliant, and the gaps are usually straightforward to close.
This article describes practical implementation patterns from delivery experience. It is not legal advice. Confirm your specific obligations with qualified Saudi legal counsel.
Who it applies to
The PDPL governs the processing of personal data in Saudi Arabia, and extends to organisations outside the Kingdom that process the personal data of people inside it. If your contact form collects a name, an email address or a phone number, you are processing personal data and the law applies to you.
"Personal data" is broad. It includes obvious identifiers, but also IP addresses, device identifiers and behavioural data that can be linked back to an individual — which is what most analytics and advertising tooling collects by default.
The principles that shape implementation
- Lawful basis. You need a valid reason to process — consent, contract performance, legal obligation or legitimate interest.
- Purpose limitation. Collect for a stated purpose and do not quietly reuse the data for something else.
- Data minimisation. Collect only what you actually need. Every optional form field is a liability with no offsetting benefit.
- Accuracy. Keep data correct and let people correct it.
- Storage limitation. Do not keep data indefinitely because deleting it never became anyone's job.
- Security. Apply appropriate technical and organisational protection.
- Accountability. Be able to demonstrate compliance, not merely assert it.
What this means on your website
1. A privacy policy people can actually read
Published in Arabic and English, stating what you collect, why, on what legal basis, who you share it with, how long you keep it, where it is processed and how to exercise rights. Link it from the footer of every page and from every form. A policy copied from a European template and never adapted is a visible signal that nobody reviewed it.
2. Consent that is genuinely optional
Consent must be freely given, specific, informed and as easy to withdraw as to give. In practice that means non-essential cookies do not fire before the user chooses, rejecting is as easy as accepting, marketing consent is a separate unticked checkbox rather than bundled into terms acceptance, and the choice is recorded with a timestamp.
3. Cookie handling that matches the banner
The most common failure we find in audits is a banner that appears while analytics and advertising scripts have already loaded. If the tags fire before consent, the banner is decorative. Configure your tag manager so non-essential tags are genuinely gated behind the consent signal, then verify it in the network tab rather than trusting the configuration screen.
4. Forms that collect less
Review every form field and ask what happens if you remove it. Most business enquiry forms collect a company name, a job title and a budget range that nobody ever reads. Each is data you now have to protect, retain and delete.
5. A working rights process
People can request access, correction, deletion and withdrawal of consent. That means a monitored channel, a named owner, an internal procedure, and the technical ability to actually find and delete someone's data across your CRM, email platform, analytics and backups. The technical ability is the part most organisations discover they lack only when the first request arrives.
A privacy policy is a promise. Compliance is whether your systems can keep it.
Data transfers and residency
Transferring personal data outside the Kingdom carries conditions. In practice this affects almost every website, because hosting, email, analytics and CRM tooling are frequently operated abroad.
- Map where every piece of personal data actually lives, including subprocessors
- Check whether your sector or contracts impose in-Kingdom residency
- Prefer providers offering a Saudi or regional data centre where residency matters
- Ensure processor contracts include appropriate data protection terms
- For AI features on sensitive data, consider self-hosted open-weight models so nothing leaves your infrastructure
Implementation checklist
- Publish a bilingual privacy policy specific to your organisation
- Publish a cookie policy listing the cookies you actually set
- Deploy a consent mechanism where reject is as easy as accept
- Gate all non-essential tags behind consent and verify in the network tab
- Store consent records with timestamp and version
- Remove unnecessary form fields
- Add a separate, unticked marketing consent checkbox
- Define retention periods per data type and automate deletion
- Create a monitored channel and internal runbook for data subject requests
- Maintain a record of processing activities and subprocessors
- Encrypt data in transit and at rest, and restrict access by role
- Have a documented breach response plan with named owners
- Review annually and after any significant system change
Where to start if you have done nothing
In our experience the highest-value first three steps are: fix the tag gating so nothing fires before consent, publish an accurate bilingual privacy policy, and delete the form fields you never use. Those three take a few days, remove most of the visible exposure, and make the remaining work considerably easier to scope.
Frequently asked questions
Does the Saudi PDPL apply to my website?+
If your website collects personal data from people in Saudi Arabia — including names, emails, phone numbers, IP addresses or behavioural analytics — the PDPL applies, whether or not your organisation is based in the Kingdom.
Do I need a cookie consent banner in Saudi Arabia?+
If you set non-essential cookies such as analytics or advertising, you need a mechanism to obtain consent before they load, with refusal as easy as acceptance and the choice recorded.
Can personal data of Saudi residents be stored abroad?+
Cross-border transfers are permitted under conditions. Map where data actually resides, check sector-specific residency requirements, and ensure processor contracts include appropriate protections.
What rights do individuals have under the PDPL?+
The rights to be informed, to access their data, to request correction, to request deletion, and to withdraw consent. You need a monitored channel and the technical ability to fulfil these requests.
What is the most common PDPL failure on Saudi websites?+
Consent banners that appear after analytics and advertising tags have already loaded. The banner looks compliant while the underlying behaviour is not. Verify tag gating in the browser network tab.
How long should we keep enquiry data?+
Only as long as needed for the stated purpose plus any statutory retention requirement. Define a period per data type, state it in your privacy policy, and automate deletion rather than relying on manual cleanup.