The framework
Saudi Arabia regulates personal data through the Personal Data Protection Law (PDPL), dating from 2021 and supervised by the Saudi Data and AI Authority.
For advertisers the consent posture matters most, and Saudi Arabia sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Personal Data Protection Law (PDPL), amended 2023
Saudi Arabia runs the Gulf's most consequential regime. The PDPL took full effect 14 September 2023, its enforcement grace period ended 14 September 2024, and SDAIA has since published registration, DPO and transfer rules. In January 2026 its violation committees announced their first 48 enforcement decisions, including penalties for marketing messages sent without consent. Marketing requires consent and a working opt-out, and sensitive-data marketing is prohibited outright.
Marketing and advertising
Consent is the default basis; the 2023 amendments added legitimate-interest room for non-sensitive data, but direct marketing effectively requires consent plus an opt-out in every message. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfer regulations (2024) allow adequacy-based transfers, safeguards (SCCs, BCRs, certification) and risk assessments; SDAIA has not published a list of adequate countries, so safeguards do most of the work.
Enforcement and penalties
Fines up to SAR 5M (doubled for repeats), criminal exposure for sensitive-data disclosure, plus SDAIA corrective powers.