The new legislation looks to align the country with
international standards on protecting individuals'
data
This note has been prepared to provide an overview of the
Personal Data Protection Law (the PDPL or Law) of the Kingdom of
Saudi Arabia (the Kingdom)1 and its accompanying
implementing regulations (the Implementing Regulations)2
which ultimately came into force on 14 September 2023 (the
Effective Date). The PDPL aims to align the Kingdom's data
protection framework more closely with international standards,
particularly the General Data Protection Regulation (GDPR), a data
privacy regulation adopted across the European Union (EU).
Entities have a one-year grace period from the Effective Date to
ensure compliance with the provisions of the PDPL, ending on 14
September 2024.
