Services
Yes. If your website or online store collects a name, mobile number, email or shipping address from people in the Kingdom, you are covered by the Saudi Personal Data Protection Law (PDPL). The law has been in force since 14 September 2023, the grace period for compliance ended on 14 September 2024, and SDAIA's violations review committees have started issuing decisions. In practice, applying the Personal Data Protection Law to websites means four things: a clear privacy policy, valid consent before marketing and tracking, a way for customers to exercise their rights, and technical protection for the data and for whoever you share it with. We will not walk through the law article by article; we will translate it into what gets checked directly on your website: contact forms, the WhatsApp button, ad pixels, hosting and the disclosure page, with a 15-point checklist and an approximate cost table in SAR.
Important notice: this article is technical awareness content intended to help you understand the requirements and apply them to your website; it is not legal advice. Laws and regulations can be updated, and the final reference is the official text published on the Bureau of Experts and SDAIA platforms. For special cases (health or financial data, or a business built on processing data), consult a specialized lawyer.
The Personal Data Protection Law was issued by Royal Decree No. (M/19) dated 9/2/1443H, then amended by Royal Decree No. (M/148) dated 5/9/1444H, and its implementation is overseen by the Saudi Data & AI Authority (SDAIA) as the competent authority. Its aim is to protect individuals' privacy and regulate how entities collect, use and share their data. Its philosophy is close to well-known international laws, but it has its own Saudi specifics on consent, cross-border data transfer and registration.
You can read the full text on the Bureau of Experts at the Council of Ministers platform, and the supporting guides and regulations on SDAIA's National Data Governance Platform.
| HISTORY | What happened | What it means for your website |
|---|---|---|
| September 2021 (1443H) | Law issued by Royal Decree (M/19) | The start of the legal framework |
| March 2023 (1444H) | Law amended by Royal Decree (M/148) | Some restrictions eased and a "legitimate interest" basis added |
| 14 September 2023 | The law entered into force with its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom | Obligations took effect |
| 14 September 2024 | The one-year grace period for compliance ended | There is no longer a general grace period |
| September 2024 | The Regulation on Personal Data Transfer outside the Kingdom was updated and standard contractual clauses were adopted | Important for anyone using external hosting or tools |
| January 2026 | SDAIA's violations review committees announced 48 decisions confirming violations during the previous year | Enforcement began with published figures |
| June 2026 | The committees announced new decisions against a number of violating entities | Enforcement became a reality, not a theory |
The law applies to any processing of personal data that takes place in the Kingdom, and to the processing of data of individuals residing in it, even by entities outside it. The main exception is an individual processing data purely for personal or family use. Any company, sole proprietorship, store on Salla, Zid or WooCommerce, or even a landing page for an ad campaign, falls within scope as long as it collects data from people for commercial purposes.
More than most website owners expect. The definition covers any data that could lead to identifying an individual directly or indirectly. On a typical Saudi website you will find:
The law classifies some data as "sensitive", including health and genetic data, credit data, ethnic or tribal origin, religious belief, and security and criminal data. If your website belongs to a clinic or a salon that records a health condition, or to a financing and installment platform, your processing needs explicit consent and cannot rely on "legitimate interest", and the criminal penalty in the law is tied specifically to disclosing this type of data.
You, the store owner, are the "controller": the one who decides why data is collected and how it is used. The hosting company, the store platform, the payment gateway, the email marketing tool and the WhatsApp API provider are usually "processors" acting on your behalf. The main responsibility stays with you: the law requires you to choose processors that provide sufficient guarantees for protecting data and to monitor their compliance. So it is not enough to say "the platform is responsible".
Not every website is required to register. Under the rules governing the national register of controllers, registration on the National Data Governance Platform is required if the entity is public, if its core activity is based on processing personal data, or if it processes sensitive data. Appointing a personal data protection officer is required in specific cases, most notably when the core activity involves processing that requires regular and systematic monitoring of individuals, or processing sensitive data. A small fashion store in Jeddah is usually not required to register, but a dental clinic in Riyadh with an online booking system should check seriously.
Setting the legal language aside, these seven obligations are what the Personal Data Protection Law means for websites in design and development. Each has a direct effect on a page, a form or a technical setting.
The law requires the controller to adopt a privacy policy and make it available to data subjects before collecting their data. A policy copied from a foreign website that cites the "GDPR" and California state laws is not a policy; it is evidence of not caring. A proper policy states clearly:
And if you want a ready structure for a Saudi store's privacy policy, build it on eight subheadings: the purpose of processing, the data we collect, the legal basis, sharing with third parties, transfer outside the Kingdom, retention period, your rights and how to exercise them, and how to contact us.
Consent is the best-known basis, but not the only one. Processing a customer's address to ship their order relies on performing the contract with them and does not need a separate consent box. Sending marketing messages, activating ad pixels or using data for a new purpose, however, needs clear consent. Importantly, the law does not allow consent to be made a condition of providing the service if the processing is not related to it, and it gives the data subject the right to withdraw consent at any time. Technically, that translates into an unticked marketing consent box, separate from the "Place order" button.
Customers have the right to know how their data is processed, to access it and obtain a copy, to correct it, and to request its destruction once it is no longer needed. The Implementing Regulation points to responding to requests within a period not exceeding 30 days, with the possibility of extension in specific cases. Your website needs a published channel for these requests: a dedicated email or form, and an internal procedure in which staff know who responds and where to pull the data from.
Do not ask for what you do not need. A "Request a quote" form needs neither a date of birth nor an ID number. Every extra field is extra data you are responsible for, and extra risk in any breach. This rule alone solves many of the common compliance problems on websites.
The law requires the organizational, administrative and technical measures needed to protect data. The regulation requires notifying SDAIA within 72 hours of becoming aware of a breach likely to harm the data or its owners, and notifying the data subject if harm results. This means your website needs HTTPS, regular updates, limited permissions for the control panel, backups, and a log showing when and how any incident was discovered. For the technical details, see our website security and protection guide for Saudi Arabia.
Customers must know that their data passes through the hosting provider, the payment gateway, the shipping company and the email tool. You are not necessarily required to name every brand, but you must explain the categories and purposes, and have processing contracts that protect the data with every provider.
Keep a written record of processing activities: what data, for what purpose, who can access it, where it is stored and when it is destroyed. This is the first thing requested in any audit. And if the processing involves sensitive data, systematic tracking of visitors or large-scale transfers abroad, carry out a privacy impact assessment (DPIA) before starting and document it. With every provider that processes data on your behalf (hosting, email, WhatsApp API), sign a data processing agreement (DPA) that sets out its obligations.
This is where most store owners fall into the gray area, because every modern marketing tool sends data to servers outside the Kingdom.
The Saudi law has no article that names "cookies" explicitly, as some European laws do. But when cookies and tracking identifiers collect data that can be linked to a person, that is processing of personal data subject to the rules on consent and disclosure. The cautious approach we recommend: cookies essential to running the website (cart, login) work immediately with disclosure, while analytics and advertising cookies only run after the visitor consents through a clear banner with a "Reject" button as visible as the "Accept" button.
A pixel sends browsing data, and sometimes the customer's email and mobile number in hashed form when "advanced matching" or server-side conversions are enabled, to a platform outside Saudi Arabia. This does not mean pixels are prohibited; it means three steps: consent before activation, disclosure in the privacy policy, and making sure the data transfer follows the rules. Tools such as Google's Consent Mode let you keep measuring campaigns in aggregate when a visitor declines, instead of choosing between compliance and measurement. And if you run ad campaigns, this point is worth reviewing with the digital marketing team before any new campaign.
The law does not generally require the private sector to host data inside Saudi Arabia, but it regulates transfers abroad. Article Twenty-Nine and the Regulation on Personal Data Transfer outside the Kingdom allow transfers where there is an adequate level of protection, or through safeguards such as the standard contractual clauses adopted by SDAIA in September 2024, or binding corporate rules for groups. Government entities and some regulated sectors (finance, health, telecom) have additional requirements from their regulators that may require local hosting. The practical rule: know where your servers are, keep the processing contract with your hosting provider, and mention the transfer in your privacy policy.
When a customer sends their number and request through a WhatsApp button or a chatbot, that is personal data passing through an external provider. It becomes more sensitive when conversations are sent to an external AI model for analysis or automated replies. Before connecting any tool of this kind, ask: where are the conversations stored? Are they used to train the model? Can they be deleted on request? We covered these limits in our article on AI agents for Saudi businesses, and the cost of the setup itself in our article on WhatsApp chatbot cost.
Does your website fire pixels before the visitor consents?
We check your website's forms, pixels and hosting with you in a free consultation, then set up the consent banner and privacy page technically in line with the Personal Data Protection Law.
This list is written to be checked on the website itself, not just read. Open your website in a private browser window and go through the items one by one. Any item you cannot answer with a clear "yes" is your next task.
Items 5 to 12 are purely technical and need a developer, while items 13 to 15 need a management decision and legal drafting. This split helps you know who to assign what to. And if your website runs on WordPress, many of these items can be included in the regular maintenance contract; see what the contract should cover in our article on website maintenance cost in Saudi Arabia.
The cost depends on the size of the website, the number of tools connected to it and the type of data. The following table gives approximate ranges as of 2026 for a mid-sized company website or store in Riyadh, Jeddah or Dammam, and they vary by provider and website complexity. Prices exclude 15% VAT.
| Item | Approximate cost (SAR) | Notes |
|---|---|---|
| Cookie consent management platform (CMP) | Free with limited features, or about SAR 40–210 per month per domain | Global tools are priced in dollars and change; WordPress plugins are available for about SAR 220 per year |
| Technical setup: consent banner, configuring pixels and Consent Mode, updating forms | 2,000 – 8,000 | One-time; rises with the number of tracking tools |
| A custom privacy policy page and its legal review | 1,500 – 6,000 | Estimated; varies greatly by law firm and business complexity |
| Rights request form and an internal response procedure | 1,000 – 3,500 | Can be integrated with a ticketing system or CRM |
| Website security check and closing basic vulnerabilities | 3,000 – 15,000 | Depends on website size and depth of testing |
| SSL certificate | 0 – 1,500 per year | Free certificates are enough for most websites |
| Periodic follow-up under the maintenance contract | Usually included in the monthly package | Reviewing new tools and removing old accounts |
For comparison: building compliance into a new website project from the start is far cheaper than fixing it later, because the forms, disclosure pages and script loading are designed correctly once. That is why we include these items by default in website design and online store development at Bateel, instead of making them a paid add-on after launch.
Much of the content circulating online says "a SAR 5 million fine" as if it were imposed automatically for every mistake. That is inaccurate. The figures in the law are upper limits, and the penalty is set according to the type, gravity and extent of the violation. Here is a summary of the provisions as they appear in the law after its amendment:
| Article | Violation | Penalty as stated in the text |
|---|---|---|
| Thirty-Five | Disclosing or publishing sensitive data in breach of the law with intent to harm its owner or to gain a personal benefit | Imprisonment for up to two years, or a fine of up to SAR 3 million, or both |
| Thirty-Six | Violating any other provision of the law or its regulations (outside the cases of Article 35) | A warning, or a fine of up to SAR 5 million, and the fine may be doubled for repeat violations, up to twice the maximum |
| Thirty-Eight | Supplementary penalties | The court may confiscate funds obtained from the violation and publish a summary of the judgment at the violator's expense |
| Forty | Harm suffered by the data subject | The data subject's right to claim compensation for material or moral harm |
Note two things. First, the criminal penalty (imprisonment) is tied to one specific case, disclosing sensitive data with intent to harm or benefit, and is not a penalty for forgetting a cookie banner. Second, Article 36 starts with a warning, which means an administrative violation may end with a warning or a fine far below the maximum, depending on the case.
In January 2026, SDAIA's committees for reviewing violations of the law announced that during the previous year they had issued 48 decisions confirming violations and imposing penalties (Saudi Press Agency). In June 2026, they announced new decisions against a number of entities imposing the penalties prescribed by law, without disclosing the fine amounts or the names of the entities. Violations mentioned in the two announcements include:
The message for store owners is clear: WhatsApp messages, text messages and marketing emails sent to customers who did not consent are among the most realistic risks, and at the same time among the easiest to fix.
When reviewing company websites and stores, the same mistakes keep coming up, and most of them do not need a big budget:
And if you are launching a new store, also see the requirements for opening an online store in Saudi Arabia so you bring the commercial, technical and privacy requirements together in one plan.
Yes. The law does not exempt businesses by size, so every store that collects customer data in Saudi Arabia for commercial purposes is covered. The difference is that a small store that does not process sensitive data is usually not required to register on the SDAIA platform or appoint a data protection officer, but it does need a privacy policy, consent and data protection.
General violations are punishable by a warning or a fine of up to SAR 5 million, which may be doubled for repeat violations. Disclosing sensitive data with intent to harm or benefit is punishable by imprisonment of up to two years, a fine of up to SAR 3 million, or both. These are maximum limits, set according to the gravity of the violation.
The law does not name cookies explicitly, but analytics and advertising cookies that can be linked to a person count as processing of personal data that needs a legal basis and disclosure. The safest practice is a banner that clearly offers accept and reject, and only activates pixels after consent, while keeping essential cookies enabled.
Not in itself, for most private sector businesses. The law allows data to be transferred abroad under the controls of Article 29 and the transfer regulation, such as an adequate level of protection or standard contractual clauses. But some regulated sectors and government entities have local hosting requirements, so check with your regulator.
The Implementing Regulation points to responding to data subjects' requests within a period not exceeding 30 days, with the possibility of extension in specific cases. So set up a published channel for requests and a clear internal procedure, and remember that some data may have to be kept for a statutory period, such as invoices.
Complying with the Personal Data Protection Law for websites and stores is not a complex legal project in most cases; it is a set of clear technical and management decisions: forms with fewer fields, pixels that do not run before consent, hosting whose location is known, a privacy policy that reflects your business, and a channel that receives customer requests. It is also a marketing advantage, because Saudi customers have become more aware of who they give their mobile number to.
At Bateel Tech Solutions, we review your website or store against the checklist above and implement its technical part: the consent banner, pixel configuration, form updates, disclosure pages and security hardening, and you can involve your legal adviser in drafting the policy. Contact us on WhatsApp or through our Contact Us Page and get a free initial review of your website.
