Law note · Saudi Arabia

Personal Data Protection Law, comprehensive regime and lawful basis

cite Royal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12 stage IN FORCE in force since 2023-09-14 kind Comprehensive regime binds public and private bodies reviewed 2026-08-29

What it requires

An app that collects, uses, or discloses the personal data of an individual in Saudi Arabia must establish a lawful basis under the Personal Data Protection Law, most commonly the Data Subject's consent, following the consent mechanics set out in the Implementing Regulations.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

What we found

The Personal Data Protection Law is Saudi Arabia's comprehensive personal-data statute, with the Implementing Regulations supplying the operative consent-mechanics detail (Arts. 4, 11-12). Consent is the default lawful basis; other grounds are set out in the Law's Art. 6 area, not individually enumerated in this research pass. A Controller/Processor structure is present.

SDAIA is the Competent Authority for most sectors (Law Art. 1(3)), with the Saudi Central Bank (SAMA) designated as the Competent Authority for its own regulated financial sector, a sector-split enforcement structure.

Primary source

official statute and Implementing Regulations text, SDAIA document library

← Back to the example · Lint your app →