PDPL takes effect; full enforcement follows in September 2024
By Cicada DeskEvent date: 1 min read
Added to the archive: Last verified:
In brief
The Saudi Data and Artificial Intelligence Authority (SDAIA) published the Implementing Regulations of the Personal Data Protection Law (PDPL) and the Personal Data Transfer Regulations on 7 September 2023, a week before the amended law took effect on 14 September 2023.
The Saudi Data and Artificial Intelligence Authority (SDAIA) published the Implementing Regulations of the Personal Data Protection Law (PDPL) and the Personal Data Transfer Regulations on 7 September 2023, a week before the amended law took effect on 14 September 2023. Organizations received a 12-month grace period, and full enforcement began on 14 September 2024.
The regulations require breach notification to SDAIA within 72 hours, responses to data-subject requests within 30 days, and explicit consent for sensitive data and automated decisions.
Key figures
- 72breach notification window (hours)
- 12grace period (months)
Sources
This report is compiled from the sources below. Cicada links to every source we rely on.
- 1Saudi Arabia issues Implementing Regulations to the Personal Data Protection Law Clyde & Co
- 2Saudi Arabia: New amendments have been introduced to the Personal Data Protection Law Baker McKenzie
Archive report. Written in 2026 from contemporary sources and dated to the day the event happened.
Cite this story
Cicada Desk. "PDPL takes effect; full enforcement follows in September 2024". Cicada, 14 September 2023. https://cicadaconsultancy.online/en/news/pdpl-in-force-2023
Free to quote and reuse with attribution under CC BY 4.0.
