PDPL Compliance in Saudi Arabia: A Practical Checklist for Websites and Marketing Teams

PDPL Compliance in Saudi Arabia: A Practical Checklist for Websites and Marketing Teams

PDPL compliance in Saudi Arabia is no longer only a legal or IT matter. Every contact form, newsletter sign-up, WhatsApp campaign and advertising pixel on a Saudi-facing website collects personal data, and the Personal Data Protection Law (PDPL) sets clear rules for how that data is collected, used, shared and kept. Marketing and IT leads are usually the people who own these tools, so they are also the people who need a working checklist.

This guide translates the PDPL and its Implementing Regulations, issued by the Saudi Data & AI Authority (SDAIA), into practical steps for websites and marketing teams. It builds on our broader guide to cybersecurity, PDPL and NCA compliance in Saudi Arabia and covers the daily decisions: privacy policy content, consent on forms and cookie banners, email, SMS and WhatsApp rules, and what to fix first.

Table of Contents

• What the PDPL is and who it applies to
• Lawful basis and consent for forms, marketing and cookies
• PDPL compliance in Saudi Arabia for websites: privacy policy, forms and retention
• Marketing consent for email, SMS, WhatsApp, analytics and ad pixels
• Data subject rights, records, the DPO and registration
• Cross-border transfers and data breach notification
• A 12-point PDPL checklist and what to do first

What the PDPL is and who it applies to

The PDPL was issued by Royal Decree No. M/19 dated 9/2/1443 AH and amended by Royal Decree No. M/148 dated 5/9/1444 AH. SDAIA supervises it and publishes the Implementing Regulations of the Personal Data Protection Law and supporting rules. Under Article 2 of the Personal Data Protection Law (official English text), it covers processing that takes place in the Kingdom and processing of data of individuals residing in the Kingdom by any party outside it. A Dubai head office or a European agency running campaigns for Saudi residents is in scope for that data.

• Controller. The entity that decides why and how data is processed: your company, for its leads, customer lists and audiences.
• Processor. A party processing data on your behalf, such as a host, email platform, CRM, agency or chatbot vendor. The controller remains responsible for choosing and monitoring processors.

Personal data includes names, phone numbers, addresses, photos and anything else that can identify a person directly or indirectly. Article 36 allows a warning or a fine of up to SAR 5 million for violations, which may be doubled for repeat violations; Article 35 sets heavier penalties for unlawfully disclosing sensitive data with intent to harm or for personal benefit.

Lawful basis and consent for forms, marketing and cookies

Under Article 5 of the law, personal data may not be processed, or used for a new purpose, without consent, except in the cases listed in Article 6, such as processing required by another law, performing an agreement with the individual, or the controller's legitimate interest where no sensitive data is involved.

Article 11 of the Implementing Regulations sets the conditions for valid consent:

• Freely given. No pre-ticked boxes or misleading wording, and, under Article 7 of the law, no making a service conditional on unrelated consent.
• Specific. A separate consent for each purpose, explained before it is requested. One tick for "terms, newsletter and partner offers" falls short.
• Documented. A record of when and how consent was given.
• Easy to withdraw. Withdrawal must be as easy as giving consent (Article 12 of the Regulations).

Legitimate interest is not a shortcut: it requires non-sensitive data, processing within the individual's reasonable expectations, and a documented impact assessment before processing starts.

Cookies and tracking

The PDPL has no dedicated cookie article, but cookies and pixels linked to identifiable visitors are personal data processing, so they need a lawful basis and must be disclosed. SDAIA's privacy policy guideline lists cookie data as a category to disclose and suggests linking a cookie policy. A defensible approach is to load only technically necessary cookies by default and activate analytics and advertising tags after the visitor chooses in the cookie banner.

PDPL compliance in Saudi Arabia for websites: privacy policy, forms and retention

Article 12 of the law requires a privacy policy available before data is collected, and Article 4 of the Regulations lists what people must be told. SDAIA's Privacy Policy Guideline includes a model structure. A Saudi website privacy policy should state:

• Who you are. Controller identity and contact details, plus the Data Protection Officer's details where one is appointed.
• Purpose and legal basis. For each type of collection, and which fields are mandatory or optional.
• Data and methods. What forms, chat, cookies and analytics collect.
• Recipients and transfers. Who receives data and whether it is processed outside the Kingdom.
• Retention and rights. How long data is kept, how to exercise rights and how to withdraw consent.

For an example covering forms, meeting requests, an AI chat assistant, cookies and opt-in newsletters, see the Sokrab Saudi Arabia website privacy policy.

Forms and retention

• Keep fields to the minimum needed, as Article 11 of the law requires.
• Place a short notice and privacy policy link beside the submit button.
• Use a separate, unticked checkbox for marketing, and store the consent record (date, form, wording shown) with the lead.
• Set a retention period for each data set and automate deletion: Article 18 requires destruction once data is no longer needed, unless a law or court case requires retention.

Our WordPress development and maintenance guide explains how plugins, form storage and backups affect what a website actually keeps.

Marketing consent for email, SMS, WhatsApp, analytics and ad pixels

Article 25 of the law bars using a person's means of communication, including post and email, for advertising without prior consent and a clear way to opt out. Article 26 allows non-sensitive data to be used for marketing where it was collected directly from the individual with consent. Articles 28 and 29 of the Regulations add rules for every channel:

• Consent before sending where there has been no prior interaction, which makes bought or scraped lists high risk.
• Clear sender identity in every message.
• A free opt-out as easy as subscribing, honoured immediately.
• Evidence of consent for each recipient.

These rules apply alongside the Telecommunications and Information Technology Act and platform policies, so SMS and WhatsApp campaigns must meet both. Our article on mobile marketing in Saudi Arabia through SMS, WhatsApp and apps covers the channel side.

Analytics, pixels and third-party tools

• Map every tag. List each analytics, advertising and session-recording tool, what it collects and which vendor receives it.
• Contract with processors. Article 17 of the Regulations requires agreements covering purpose, data categories, duration, breach notification and sub-processors.
• Review audience uploads. Uploading customer lists to ad platforms is a disclosure, often outside the Kingdom, and needs a lawful basis.
• Assess impact. Article 25 of the Regulations requires an impact assessment when linking datasets from different sources or continuously monitoring individuals.

Data subject rights, records, the DPO and registration

Article 4 of the law gives individuals the right to be informed, to access and obtain a copy of their data, to request correction, and to request destruction of data no longer needed. Under Article 3 of the Regulations, controllers must act within 30 days (extendable by 30 days with notice and reasons), verify identity and log every request, including oral ones. Train sales and support teams to recognise a rights request arriving by WhatsApp or phone.

• Record of processing. Article 33 of the Regulations requires a written, current record of purposes, data categories, retention, recipients, transfers and security measures, kept for five years after processing ends.
• Data Protection Officer. Under Article 32, a DPO is required where core activities involve regular and systematic monitoring of individuals or sensitive data, or where a public entity processes data on a large scale. The DPO may be an employee or an external contractor.
• Registration. SDAIA's rules require some controllers, including those whose main activity is processing personal data or that process sensitive data, to register on the National Data Governance Platform.

Cross-border transfers and data breach notification

Cloud CRMs, email platforms, ad networks and AI tools are often hosted abroad. Article 29 of the law permits transfers for specified purposes where they do not prejudice national security or vital interests, protection abroad is adequate, and only the minimum data is sent. The Regulation on Personal Data Transfer outside the Kingdom explains how SDAIA assesses adequacy and when controllers may rely instead on safeguards such as standard contractual clauses, binding common rules or accreditation certificates, sometimes with a prior transfer risk assessment. List every system that stores data abroad, record the basis and safeguard for each, and reflect this in your privacy notice.

For breaches, Article 24 of the Regulations requires the controller to notify SDAIA within 72 hours of becoming aware of an incident that may cause harm, through the National Data Governance Platform according to SDAIA's breach guidance, and to inform affected individuals without undue delay. Require vendors to report breaches to you promptly, or the 72-hour window becomes hard to meet. A cybersecurity assessment and IT controls review can help test incident response readiness before an incident occurs.

A 12-point PDPL checklist and what to do first

Assign an owner to each line and keep evidence of completion in one place.

Where to start: build the data map first (item 1), because every other decision depends on it. Next, fix the public-facing items (3 to 7), which customers and the regulator can see. Then put processor agreements and the breach plan in place (8 and 12).

PDPL rules and SDAIA guidance may be updated, so confirm current requirements with SDAIA or a qualified legal adviser before finalising your policies.

Frequently Asked Questions

Need help reviewing your website and marketing tools against the PDPL? Contact Sokrab Saudi Arabia today.