Saudi PDPL compliance for websites
Saudi Arabia’s PDPL reaches you wherever you are.
If you process the data of people in the Kingdom, the PDPL applies, even if your company sits somewhere else. Marketing data has to be collected directly, with consent, and the regulator has been issuing fines since the grace period ended. ConsentBit asks before the trackers run and records the answer.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
Marketing waits for a yes, every time.
Consent withdrawn is consent acted on.
The Kingdom’s privacy law, enforced by SDAIA.
The Personal Data Protection Law (PDPL), issued by Royal Decree M/19 and amended by M/148, protects the personal data of people in Saudi Arabia. The Saudi Data and AI Authority (SDAIA) supervises it. The law reaches organisations outside the Kingdom when they process the data of people residing in it.
Maximum fine
SAR 5 million
per violation, and the fine can be doubled for a repeat offence.
Enforced since
the compliance grace period ended on 14 September 2024
Sensitive data
disclosing it to cause harm carries up to two years in prison, or a fine of up to SAR 3 million
Five things the PDPL expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What PDPL requires
A privacy policy available before you collect anything (Article 12)
How ConsentBit handles it
The banner links to your policy on the first screen, before scripts run.
What PDPL requires
Consent before data is processed, unless an exception applies (Article 5)
How ConsentBit handles it
Analytics and Marketing stay blocked until the visitor agrees.
What PDPL requires
Marketing data collected directly, with consent (Article 26)
How ConsentBit handles it
Marketing scripts are held until the visitor allows that category.
What PDPL requires
Withdrawal of consent at any time (Article 5)
How ConsentBit handles it
A floating button on every page reopens the panel, and the new choice applies straight away.
What PDPL requires
Records of your processing activities (Article 31)
How ConsentBit handles it
Every choice is logged with the date and time, ready to export.
Article 11 adds that collection must not involve deception or misleading, which is the Saudi version of the rule against burying the Reject button.
What a visitor sees, step by step
Nothing optional runs until the visitor decides.
They land on your site
The banner explains what is collected, why, and links to your privacy policy. Analytics and Marketing are blocked.
They choose
Accept all, Reject all, or pick categories in the preferences panel.
The choice takes effect
Allowed categories run. Anything they didn’t allow stays blocked.
They can change their mind
A floating button on every page reopens the panel, and withdrawal takes effect immediately, as Article 5 requires.
WHAT THE PDPL ASKS FOR, AND WHAT IT DOESN’T
Consent first, with a short list of exceptions.
The PDPL has no cookie-specific rule. It has something broader: data may not be processed without consent unless one of a few exceptions applies, and marketing has a rule of its own.
Sensitive data in Saudi Arabia is wider than many teams expect. It includes religious, intellectual and political belief, racial or ethnic origin, health, biometric and genetic data.
Blocked until they agree
Nothing optional runs until the visitor answers, on every plan including the free one. Here is what that looks like.
Marketing has its own rule
Article 26 allows processing for marketing only where the data was collected directly from the person and they consented. Sensitive data can’t be used for marketing at all.
The fine doubles the second time
Article 36 allows a warning or a fine of up to SAR 5 million for most violations, and the fine can be doubled for a repeat offence.
Selling into Europe as well? See what GDPR requires →
Add a PDPL-ready banner to your site, free.
Records
A record of every consent, ready if SDAIA asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Article 31 asks controllers to keep records of their processing activities and to produce them when SDAIA requests them.
FAQ
Saudi privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to any processing of personal data that takes place in the Kingdom, and to processing from outside the Kingdom when it involves data about people residing there. There is no revenue or size threshold, so a small website selling into Saudi Arabia is covered.
The PDPL doesn’t mention cookies. It does say personal data may not be processed without consent unless an exception applies, and that marketing needs consent, so a banner is the usual way to ask and to keep the record.
Consent has to be given by the person, it can be withdrawn at any time, and it can’t be made a condition of a service unless the service is directly related to the processing. The Implementing Regulations set out when consent must be explicit.
Sometimes. Article 6 allows processing for the controller’s legitimate interest without prejudice to the person’s rights, but never where sensitive data is involved.
A warning or a fine of up to SAR 5 million for most violations, doubled for a repeat offence. Disclosing or publishing sensitive data with intent to harm someone, or for personal benefit, can carry up to two years in prison or a fine of up to SAR 3 million.
Data revealing racial or ethnic origin, religious, intellectual or political belief, security criminal convictions and offences, biometric or genetic data used to identify someone, health data, and data showing that a person’s parents are unknown.
Both start from consent and both reach beyond their own borders. The PDPL’s list of exceptions is shorter, its marketing rule is stricter because the data must be collected directly from the person, and its sensitive data category is wider. Its fines are fixed amounts rather than a share of global revenue.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Ask before you collect, and keep the record
ConsentBit holds Analytics and Marketing until a visitor agrees, acts on a withdrawal straight away, and logs every choice.
This page is a general overview of Saudi Arabia’s Personal Data Protection Law, not legal advice. The PDPL covers far more than website tracking, including breach notification, impact assessments, records of processing and transfers outside the Kingdom, which sit outside what a consent banner handles.