---
title: "PDPL takes effect; full enforcement follows in September 2024"
url: "https://cicadaconsultancy.online/en/news/pdpl-in-force-2023"
language: "en"
event_date: "2023-09-14"
published: "2026-10-03"
last_verified: "2026-10-03"
category: "Policy"
publisher: "Cicada (cicadaconsultancy.online)"
license: "CC BY 4.0"
---

# PDPL takes effect; full enforcement follows in September 2024

- Event date: 14 September 2023 (2023-09-14)
- Topic: Policy
- In this story: PDPL, SDAIA
- URL: https://cicadaconsultancy.online/en/news/pdpl-in-force-2023

The Saudi Data and Artificial Intelligence Authority (SDAIA) published the Implementing Regulations of the Personal Data Protection Law (PDPL) and the Personal Data Transfer Regulations on 7 September 2023, a week before the amended law took effect on 14 September 2023. Organizations received a 12-month grace period, and full enforcement began on 14 September 2024. The regulations require breach notification to SDAIA within 72 hours, responses to data-subject requests within 30 days, and explicit consent for sensitive data and automated decisions.

## Key figures

- breach notification window (hours): 72
- grace period (months): 12

## Sources

1. [Saudi Arabia issues Implementing Regulations to the Personal Data Protection Law](https://www.clydeco.com/en/insights/2023/09/saudi-arabia-issues-implementing-regulations) — Clyde & Co
2. [Saudi Arabia: New amendments have been introduced to the Personal Data Protection Law](https://insightplus.bakermckenzie.com/bm/data-technology/saudi-arabia-new-amendments-have-been-introduced-to-the-personal-data-protection-law) — Baker McKenzie

Archive report. Written in 2026 from contemporary sources and dated to the day the event happened.

---

Cicada · The signal in Saudi AI.
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Full archive for language models: https://cicadaconsultancy.online/llms-full.txt