Saudi PDPL Penalties and SDAIA Enforcement: Fines, Criminal Penalties and the 2026 Decisions

WaqiSec Compliance Team · Last reviewed: 2026-10-14

PDPL penalties at a glance

We could not open the consolidated amended text on the Bureau of Experts site, so the article numbers above follow the published law as reported article by article and the 2026 SDAIA announcements, which cite Article 36. Check the official text before relying on a specific article in a dispute.

Administrative fines under Article 36

Article 36 is the penalty that matters for most companies. Any breach of the PDPL or its Implementing Regulations that is not the Article 35 crime can lead to a warning or a fine of up to SAR 5 million, and the fine can be doubled for a repeat violation.

Note that the ceiling applies per violation. A company that markets without consent, has no breach procedure and ignores data subject requests could face separate findings for each.

The criminal offence under Article 35

Only one act is a crime under the amended PDPL: disclosing or publishing sensitive data in breach of the law, with intent to harm the data subject or to gain a personal benefit. The penalty is imprisonment of up to 2 years and/or a fine of up to SAR 3 million. The Public Prosecution investigates and prosecutes, the competent court rules, and the court may double the fine for a repeat offence.

The original 2021 law also made unlawful transfers abroad a crime, with up to 1 year and SAR 1 million. The 2023 amendments removed that offence (Clyde & Co, Al Tamimi). Many online summaries still list it.

Confiscation, publication and compensation

• Article 37 covers enforcement officers and allows tools or devices used in a violation to be held until a decision is made.
• Article 38 lets the court order confiscation of money gained from a violation, and allows a final judgment or committee decision to be published in summary at the violator's expense.
• Article 40 gives anyone harmed by a violation the right to claim compensation for material or moral damage before the competent court.

How SDAIA's violation committees work

1. A complaint arrives through SDAIA's National Data Governance Platform, or SDAIA identifies a possible violation itself.
2. SDAIA notifies the entity, which has 5 days to respond under the committee rules.
3. The committee, with at least 3 members including a technical specialist and a legal adviser, reviews the file. It can summon parties, request information and appoint experts. Hearings can be held virtually.
4. The decision is notified within 15 days.
5. The entity can appeal to the competent court within 60 days of notification.

The 5, 15 and 60-day figures come from Clyde & Co's March 2026 review of the committee rules. A 5-day response window is short, which is why having your documents ready matters more than drafting a defence later.

What the 2025 and 2026 decisions show

Three patterns stand out. First, every published penalty so far has been administrative; no prison sentences have been announced. Second, SDAIA has not published names or amounts. Third, the violations are basic: missing procedures, missing DPOs and missing consent, rather than complex technical failures. Each one maps to a document a company can prepare in advance: a breach procedure, a data subject rights procedure, a DPO decision and a marketing consent process.

The Compliance Verification Form

In July 2026 SDAIA began sending a PDPL Compliance Verification Form to registered controllers. It asks for evidence on governance, legal bases for processing, third parties, retention and destruction, data subject rights, cross-border transfers, incident response and the DPO (Clyde & Co). No deadline or submission channel has been made public. Read our guide to SDAIA registration to see whether you are on the list.

What the October 2026 draft adds

SDAIA's draft amendments to the Implementing Regulations, open for comment until 5 November 2026, do not change the fine amounts in the law. They would add a new Article 36 (Repeated) requiring entities to answer SDAIA requests within 20 business days, require notifying SDAIA of every breach within 72 hours, treat a data subject request left unanswered for 30 days as rejected so the person can complain, and set a 90-day window for complaints (Clyde & Co). These are proposals until adopted.

How to reduce your exposure

1. Map your personal data in a record of processing activities.
2. Publish a PDPL-aligned privacy notice.
3. Adopt a breach procedure with a 72-hour SDAIA notification step and test it.
4. Adopt a data subject rights procedure with a 30-day response clock.
5. Decide, in writing, whether you need a DPO.
6. Stop any marketing that lacks recorded consent.
7. Keep evidence in one folder so you can answer SDAIA within days.

PDPL enforcement readiness checklist

• We know which of our activities could trigger Article 36 findings.
• No one in the company can disclose sensitive data without authorization and logging.
• Our breach procedure meets the 72-hour notification rule.
• Data subject requests are logged and answered within 30 days.
• Our DPO decision is documented.
• Marketing consent is recorded for every contact we message.
• We could send SDAIA our core documents within 5 days.

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.