The Kingdom of Saudi Arabia ("Saudi Arabia" or the
"Kingdom") has enacted the Personal Data Protection Law
("PDPL"), the country's first comprehensive data
protection law. The PDPL was scheduled to become effective on March
23, 2022 but full implementation was recently delayed until March
17, 2023, a positive development for those subject to the law since
preparing for it will require time and effort. Entities subject to
the law - or "controllers," in the law's parlance -
will have one year from the date it comes into effect to
comply.
The law is generally similar to the European General Data
Protection Regulation ("GDPR"), with some notable
exceptions - specifically, the rules around data transfers and data
localization, legal bases for processing, and penalties for
noncompliance.
