Who Is Protected Under Saudi Arabia's PDPL?
The Saudi Personal Data Protection Law applies to all residents of the Kingdom, regardless of nationality. As an expat, if a company, employer, government body, or any other entity processes your personal data while you are residing in Saudi Arabia, you are covered — even if the organization processing your data is based outside the Kingdom.
Personal data includes any information that can identify you directly or indirectly, such as your name, ID number, email address, location data, or employment details.
---
Your Core Rights as a Data Subject
The PDPL grants you the following rights:
- Right to Access: You can request to see what personal data an organization holds about you and how it is being used.
- Right to a Copy: You are entitled to receive a clear, readable copy of your personal data.
- Right to Correction: If your data is inaccurate or outdated, you can request that it be corrected or updated.
- Right to Erasure: In certain circumstances, you can request that your personal data be deleted.
- Right to Withdraw Consent: If processing is based on your consent, you can withdraw that consent at any time.
- Right to Object: You can object to processing that you believe is unlawful or harmful to your interests.
---
Sensitive Data: Extra Protections for Expats
The law draws a clear distinction between general personal data and Sensitive Data. Sensitive Data includes information about your:
- Ethnic or racial origin
- Religious beliefs
- Health or medical records
- Biometric data
- Criminal history
- Financial information beyond basic identifiers
For Sensitive Data, organizations must obtain your explicit consent before processing — a higher standard than the general consent requirement. Be especially cautious when employers, healthcare providers, or government agencies ask for this type of information.
---
Consent: What Organizations Must Tell You
Before processing your data, organizations are generally required to obtain your consent. That consent must be:
- Freely given — not coerced or bundled into unrelated agreements
- Specific — for a defined and stated purpose
- Informed — you must understand what you are agreeing to
- Clear — ambiguous or unclear consent forms do not meet the legal standard
If an organization changes the purpose for which it is using your data, it must inform you and, in most cases, obtain fresh consent.
---
How to Exercise Your Rights
- Contact the Controller directly: The organization holding your data (known as the Controller) is your first point of contact. Submit a written request specifying which right you wish to exercise.
- Keep records: Save copies of any requests you send and responses you receive.
- File a complaint with SDAIA: If the Controller does not respond appropriately, you can file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) — the body responsible for enforcing the PDPL.
- Seek legal advice: If you believe your data rights have been seriously violated, consulting a lawyer familiar with Saudi data protection law is advisable.
---
Practical Tips for Expats
- Read privacy notices carefully when signing employment contracts, rental agreements, or using Saudi digital services.
- Check app permissions on your phone — Saudi law requires that data collected be limited to the minimum necessary.
- Do not assume foreign companies are exempt: If they process data of Saudi residents, the PDPL may still apply to them.
- Know that deceased individuals are generally excluded from protection, unless their data could identify a living relative.
---
Who Enforces the Law?
SDAIA is the primary regulatory authority. It has the power to investigate complaints, conduct audits, and impose fines. Violations can result in fines of up to SAR 5 million, and intentional misuse of Sensitive Data can double that penalty. Criminal penalties including imprisonment may apply in serious cases.