Saudi data watchdog to penalize breaches of personal data protection law
Committees responsible for reviewing violations of Saudi Arabia’s Personal Data Protection Law (PDPL) imposed penalties on data controllers found to be in breach of the law and its implementing regulations, as enforcement activity continued across the Kingdom. The committees operate under the Saudi Data and Artificial Intelligence Authority (SDAIA).
During the last year, the review committees issued 48 decisions confirming violations and applying penalties prescribed under Article 36 of the PDPL. The decisions covered organizations within the scope of the law and its implementing regulations.
The confirmed violations included unlawful collection and processing of personal data, disclosure of personal information without legal justification, and failures by data controllers to put in place appropriate organizational, administrative, and technical measures to protect personal data. The enforcement actions also covered sending advertising and marketing messages to individuals without their consent.
SDAIA’s PDPL framework sets obligations for entities that control personal data handling, including requirements around lawful processing, protection of personal information, and respect for individuals’ rights. The PDPL also establishes enforcement mechanisms through committees tasked with reviewing violations and applying penalties under the law and its regulations.
Within the PDPL implementing environment, consent is treated as a core requirement for a range of processing activities, including rules that apply to processing personal data for the transmission of advertising or awareness materials. The consent requirement is reflected in regulatory provisions tied to direct marketing practices and how consent is obtained and recorded.
The enforcement actions were framed as part of ongoing oversight of PDPL implementation and its regulations, with the stated purpose of strengthening responsible data-handling practices, protecting individuals’ personal information, and reinforcing trust in digital activity across Saudi Arabia.
