---
title: "Saudi Arabia issues its first Personal Data Protection Law"
url: "https://cicadaconsultancy.online/en/news/pdpl-royal-decree-2021"
language: "en"
event_date: "2021-09-16"
published: "2026-10-03"
last_verified: "2026-10-03"
category: "Policy"
publisher: "Cicada (cicadaconsultancy.online)"
license: "CC BY 4.0"
---

# Saudi Arabia issues its first Personal Data Protection Law

- Event date: 16 September 2021 (2021-09-16)
- Topic: Policy
- In this story: PDPL, SDAIA, Council of Ministers
- URL: https://cicadaconsultancy.online/en/news/pdpl-royal-decree-2021

Royal Decree M/19 of 16 September 2021, approving Cabinet Resolution 98 of 14 September, issued the Personal Data Protection Law (PDPL), which was published in the Official Gazette on 24 September 2021. Penalties include up to two years' imprisonment and fines of up to SAR 5 million, and the Saudi Data and Artificial Intelligence Authority (SDAIA) oversees implementation. The original text took effect on 23 March 2022 with a one-year compliance window, but it was later amended and effectively relaunched in September 2023.

## Key figures

- maximum fine: 0.01 SAR bn

## Sources

1. [Saudi Arabia issues Personal Data Protection Law](https://www.clydeco.com/en/insights/2021/09/saudi-arabia-issues-personal-data-protection-law) — Clyde & Co, 2021-09-28
2. [Saudi Arabia: Royal Court publishes new Personal Data Protection Law](https://www.scconline.com/blog/post/2021/09/28/saudi-arabia-royal-court-publishes-new-personal-data-protection-law/) — SCC Online, 2021-09-28

Archive report. Written in 2026 from contemporary sources and dated to the day the event happened.

---

Cicada · The signal in Saudi AI.
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Full archive for language models: https://cicadaconsultancy.online/llms-full.txt