PDPL Cross-Border Data Transfers: How to Move Personal Data Outside Saudi Arabia Lawfully

WaqiSec Compliance Team · Last reviewed: 2026-10-01

What counts as a personal data transfer outside Saudi Arabia?

A transfer happens whenever personal data about individuals in the Kingdom is sent to, stored in or made available to a recipient outside it. Most companies transfer data daily without labeling it that way:

• SaaS tools hosted abroad: CRM, email, HR, payroll, ticketing, analytics
• a group head office in Dubai, London or the US that receives customer or staff data
• offshore support or development teams who can access production data
• backups replicated to a region outside the Kingdom

Your records of processing activities should already list each of these with the destination and the mechanism relied on. If they don't, start there.

What does PDPL Article 29 require?

Article 29 permits transfers for defined purposes: performing an obligation under an agreement to which the Kingdom is a party, serving the Kingdom's interests, performing an obligation to which the data subject is a party, or other purposes set by the Regulations. Every transfer must also meet three conditions:

1. it must not prejudice national security or the vital interests of the Kingdom;
2. the data must receive an appropriate level of protection, not lower than the PDPL's, which the Transfer Regulation achieves through adequacy or appropriate safeguards; and
3. only the minimum personal data needed should be transferred.

The 2023 amendments to the PDPL removed the earlier requirement for SDAIA approval of transfers, so there is no permit to apply for. The burden is on the controller to show the transfer is lawful.

The two routes, and the exempt cases

In practice, almost every company without an adequacy decision ends up on route 2. Keep sending only the data the recipient needs: Article 29 requires it, and the risk assessment asks how you meet it.

How do SDAIA's standard contractual clauses work?

SDAIA published its own standard contractual clauses (البنود التعاقدية القياسية) in 2024. They come in four modules:

• controller to controller
• controller to processor
• processor to controller
• processor to processor (sub-processor)

Three rules catch companies out. First, the text cannot be modified apart from completing the blank fields; SDAIA treats other changes as a violation. Second, EU SCCs are a different instrument and do not substitute for SDAIA's clauses. Third, the clauses carry live obligations, including security measures, short breach-notice deadlines between the parties so the controller can meet SDAIA's 72-hour window, and cooperation with SDAIA. See our 72-hour breach notification guide.

Binding common rules and certificates of accreditation

Binding common rules (القواعد المشتركة الملزمة) are SDAIA's equivalent of binding corporate rules. They suit multinational groups that move data between group entities on a regular basis. SDAIA has published a guideline on what they must contain, covering controller obligations, data subject rights, breach handling and records. Confirm with SDAIA how it reviews them before relying on them.

A certificate of accreditation is the third safeguard, issued by an assessment body approved for this purpose. Check with SDAIA which bodies are available before planning around it.

What are the exempt cases?

Article 4 of the Transfer Regulation lists cases that are exempted from two Article 29 conditions: the adequate level of protection and the minimum-data limit. According to SDAIA's published text they include transfers between government bodies to implement international agreements, non-repetitive and limited transfers, operational needs within a multinational group, transfers that provide a service or benefit directly to the data subject, and scientific research. Some cases exclude sensitive data, and each has its own conditions. They are not a way around safeguards: a safeguard is still required, and law-firm commentary (Hourani Partners) reads every exempt case the same way.

When is a transfer risk assessment required?

Article 7 of the amended Transfer Regulation requires a documented risk assessment in two situations:

1. transfers made under Article 4, that is, relying on an appropriate safeguard, including the exempt cases; and
2. continuous or large-scale transfers of sensitive data, even to an adequate destination.

SDAIA published a guideline on carrying out the assessment in early 2025. Clyde & Co notes it is non-binding guidance. The Global Privacy Blog summarizes it in four parts:

Where high, irreversible risk remains after mitigation, the guideline points to alternatives or stopping the transfer. Under Article 6 of the Transfer Regulation, controllers must also stop a transfer and notify the recipients if the safeguard is breached or no longer offers adequate protection.

Step-by-step plan for PDPL transfers

1. Inventory transfers from your RoPA, SaaS invoices and IT architecture.
2. Classify the data in each flow, flagging sensitive data.
3. Pick the route: adequacy (not yet available in practice) or a safeguard, and note if an exempt case applies.
4. Sign the right SCC module with each vendor or group entity, without editing the text.
5. Run and file the risk assessment for each transfer or group of similar transfers.
6. Minimize: send only the fields the recipient needs.
7. Update your privacy notice to say that data goes abroad.
8. Review yearly and when SDAIA publishes adequacy decisions or new guidance.

Sector rules can add hosting requirements on top of the PDPL, for example NCA controls for government entities and critical infrastructure operators, and SAMA rules for regulated financial institutions. Check them separately.

Common cross-border transfer mistakes

• Assuming GDPR transfer paperwork covers Saudi data
• Editing SDAIA's SCCs to match a vendor's template
• Forgetting remote access by offshore teams
• No risk assessment on file for transfers that rely on safeguards
• Treating an exempt case as a reason to skip the safeguard
• Privacy notice that does not mention transfers abroad

PDPL transfer checklist

• List of every transfer: destination, recipient, data, purpose
• Route chosen and documented for each transfer
• Correct SDAIA SCC module signed, unmodified
• Transfer risk assessment filed where required
• Sensitive data transfers reviewed separately
• Data minimized for each recipient
• Privacy notice and RoPA updated
• Annual review date set

For the wider picture, see the Saudi PDPL compliance guide.

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.