PDPL website compliance means meeting Saudi Arabia's Personal Data Protection Law wherever your website or online store collects personal data: a privacy policy people can read before they share anything, forms that ask only for what you need, a documented basis for analytics and marketing, hosting and vendors you can account for, and a 72-hour breach plan.
The law applies as soon as a contact form, a checkout or a newsletter sign-up takes a name, phone number or email from someone in Saudi Arabia. This checklist is for the owners, marketing teams and developers who run those sites. It follows the official texts published by the Saudi Data and AI Authority (SDAIA) as of October 2026. It is general information, not legal advice, so confirm your own obligations with qualified legal counsel.
The PDPL applies to any processing of personal data about individuals in the Kingdom, and Article 2 extends it to processing of residents' data by entities outside the Kingdom. A Saudi customer's details on a store hosted abroad are still in scope, whatever the size of the business. The full Personal Data Protection Law and its Implementing Regulation are on SDAIA's data governance platform. The law came into force on 14 September 2023, and organisations had a further year, to 14 September 2024, to bring their processing into line.
On a typical business website, personal data turns up in more places than the contact form:
- Contact, quote and booking forms, and the inbox or CRM they feed.
- Accounts, orders, delivery addresses and invoices in an online store.
- Newsletter and WhatsApp opt-ins.
- Analytics, advertising pixels, chat widgets and session recordings.
- Server logs, backups and staging copies of the database.
- Support tools, and the agencies or freelancers with admin access.
List these for your own site first. Every check below depends on that list.
PDPL website compliance comes down to ten checks, each tied to an article of the law, its Implementing Regulation or SDAIA guidance.
| Check | Where it comes from | What the website needs |
|---|---|---|
| 1. Privacy policy | PDPL Article 12 | An Arabic and English policy, linked from the footer and every form |
| 2. Minimal forms | PDPL Articles 11 and 13 | Only the fields you use, and a short notice at the point of collection |
| 3. Provable consent | PDPL Articles 5 and 6; Regulation Article 11 | Unticked boxes, one consent per purpose, a stored record |
| 4. Cookies and tracking | SDAIA privacy policy guideline | A script inventory, and scripts held back if consent is the basis |
| 5. Marketing messages | PDPL Article 25; Regulation Articles 28 and 29 | A separate opt-in, the sender named, an unsubscribe link in every message |
| 6. Hosting and vendors | PDPL Articles 8, 19 and 29 | Hosting region, backup locations and access agreed in writing |
| 7. Customer requests | PDPL Article 4; Regulation Article 3 | One contact route, answered within 30 days |
| 8. Retention | PDPL Article 18 | Deletion periods that reach backups and copies |
| 9. Breach plan | PDPL Article 20; Regulation Article 24 | A named owner and a 72-hour notice to SDAIA |
| 10. Records | Regulation Article 33 | A current record of processing activities |
1. A privacy policy people can read before they share data
Article 12 requires the controller, meaning the business that decides why and how the data is processed, to adopt a privacy policy and make it available before collection. The policy states the purpose, the data collected, how it is collected, stored, processed and destroyed, and people's rights and how to exercise them.
SDAIA's guideline for preparing a privacy policy is not binding, but it is the clearest picture of what the authority expects. It asks for clear, non-misleading language suited to your audience, contact details, the lawful basis for each purpose, where data is stored (including cloud providers), retention periods, security measures, how to complain, and a last-updated date. For a PDPL privacy policy on a Saudi website, publish it in Arabic as well as English, and link it from the footer and next to every form.
2. Forms that collect only what you need
Article 11 limits personal data to the minimum needed for the purpose. Look at every form field and ask what you do with it. A quote request rarely needs a date of birth or a national ID number. Remove fields nobody uses, mark which fields are required, and tell people why you ask for each one.
Article 13 lists what people must be told when you collect data directly from them, including the purpose, the legal basis, whether giving the data is mandatory, who receives it and whether it leaves the Kingdom. On a website, a short line under the submit button with a link to the matching section of the privacy policy covers much of this.
3. Consent you can prove
Consent is the main basis in Article 5, with exceptions in Article 6, and people can withdraw it at any time. Under Article 11 of the Implementing Regulation, consent must be given freely, tied to a clearly stated purpose and documented, including when and how it was given. Each purpose needs its own consent, and explicit consent is required for sensitive data.
On a website, that means unticked checkboxes, one per purpose, and a stored record of who agreed, when and to which text. The law also allows a legitimate interest basis for data that is not sensitive, with its own conditions and a documented assessment. Which basis fits each purpose is a question for your legal adviser.
4. Cookies, analytics and tracking scripts
The PDPL and its Implementing Regulation do not mention cookies by name. SDAIA's privacy policy guideline does: it names cookies and website analytics as ways of collecting data indirectly, and its template links to a separate cookie policy.
The safe engineering position for PDPL cookies in Saudi Arabia is to treat tracking as processing. Inventory every script your site loads, record what each one collects and where it sends the data, describe it in your privacy policy, and remove the scripts you no longer use. If your adviser concludes that consent is the right basis for advertising or analytics, the site must hold those scripts until the visitor agrees, and honour a later refusal.
5. Marketing emails and WhatsApp messages
Article 25 says promotional material sent to a person's contact details needs the recipient's consent and a clear way to stop receiving it. Articles 28 and 29 of the Implementing Regulation add that the sender must be clearly identified, opting out must be easy and free, proof of consent must be kept, and sending stops once consent is withdrawn.
For a store, keep marketing opt-ins separate from the checkout terms, store the consent record next to the contact, and make unsubscribing work from inside every message. WhatsApp adds Meta's own rule that businesses obtain opt-in before messaging people. Our guide to WhatsApp API costs in Saudi Arabia also covers message templates and setup.
6. Hosting, vendors and transfers
Article 19 requires organisational, administrative and technical measures to protect personal data, including during transfer. Article 8 requires you to choose processors that provide adequate guarantees, such as your host, your email platform or your agency, and to check that they comply.
Hosting inside Saudi Arabia answers where the main database sits. It does not settle backups, logs, analytics, support access or AI tools that send data elsewhere. Article 29 allows transfers outside the Kingdom under conditions set in the transfer regulation, and our list of PDPL questions for your cloud provider covers how to map those flows. Agree the hosting region, backup locations and admin access in writing. With our hosting with backups and monitoring, we agree the hosting region before you buy.
7. Requests from customers
Article 4 gives people the right to be informed, to access their data, to ask for corrections and to ask for destruction. Under Article 3 of the Implementing Regulation, you respond within 30 days. You can extend that by up to 30 more days if you tell the person in advance and give the reason.
Give people one obvious route, such as an email address in the privacy policy, and decide who answers it. For a store, check that you can find and export one customer's data across the store, the CRM, the email platform and any support inbox.
8. Retention and deletion
Article 18 requires destroying personal data without delay once the purpose of collecting it has ended, with exceptions such as a legal retention period. Set a retention period for form submissions, abandoned carts, old accounts and backups, and make sure deletion reaches the copies, not only the live database.
9. A breach plan before you need it
Article 20 of the law and Article 24 of the Implementing Regulation require the controller to notify SDAIA within 72 hours of becoming aware of a personal data breach that could cause harm. The notice describes the incident, the data and people affected, the risks and the steps taken. Affected people are told without undue delay, in plain language. SDAIA's platform has a breach notification service.
Write down who decides, who notifies SDAIA and customers, and where your logs and evidence are kept. Protect admin accounts with strong authentication and remove access for people who have left.
10. Records, registration and a data protection officer
Article 33 of the Implementing Regulation requires a written record of processing activities, kept up to date and available to SDAIA on request. Some controllers must also register in SDAIA's national register or appoint a data protection officer, for example when their core activities involve sensitive data or regular, systematic monitoring. Whether that applies to your business is a legal question.
Article 36 allows a warning or a fine of up to SAR 5 million for a violation, and the fine may be multiplied for a repeat violation, up to double the maximum. Article 35 sets imprisonment of up to two years, a fine of up to SAR 3 million, or both, for disclosing or publishing sensitive data with intent to harm the person or for personal benefit.
On 6 October 2026, SDAIA opened a public consultation on draft amendments to the Implementing Regulation, running to 5 November 2026. According to a Clyde & Co summary, the draft would require breach notice to SDAIA whether or not harm is likely, make registration mandatory in more cases, including transfers abroad, tighten marketing consent records, set new privacy policy wording rules and make storing data in the Kingdom the default. As of 21 October 2026 these are proposals, not law. Wait for the final text before changing processes.
A website team implements the decisions your business and its legal adviser make: the privacy policy page in both languages, the form fields and notices, consent records, the tag inventory, deletion jobs and access controls. Our website design and development team plans these into the forms, scripts and hosting from the first wireframe. We do not give legal opinions; we build what your adviser decides.
If you are also budgeting for a new site, our guide to what a website costs by scope lists what each plan includes.
To review an existing site, send us a review request with the forms, scripts and vendors you listed.
