Saudi PDPL compliance for websites and apps starts with a simple question: what personal data does your site or app collect, why, where is it stored, and who can access it? The Personal Data Protection Law, supervised by the Saudi Data and AI Authority (SDAIA), has been enforceable since September 2024, and most of what it asks of a website owner turns into clear design decisions and development tasks.
This is a practical guide, not legal advice. It explains what the law means for your development team and turns each obligation into an actionable task. It does not replace a lawyer who drafts your legal texts and reviews your specific situation.
Does PDPL in Saudi Arabia apply to your website or app?
If your site or app collects any information that identifies a person, such as a name, mobile number, email, address or location, you are almost certainly processing personal data. That includes a simple contact form, customer accounts in an online store, an app login and analytics tools that track visitor behaviour.
The law's text also refers to processing the data of individuals residing in the Kingdom by entities outside it, so if your company is registered outside Saudi Arabia but serves customers there, ask your lawyer whether it applies to you. Sensitivity rises sharply with health, financial or children's data, for example a clinic offering online booking; we cover that case in our guide to a clinic management system and booking app.
Step one: inventory the data your website and app collect
You cannot protect what you have not mapped. Sit down with your development team and create a simple register of every point where data is collected. Here is a template you can copy:
| Data source | Data collected | Purpose | Where stored | Retention |
|---|---|---|---|---|
| Contact form | Name, mobile, email, message | Reply to the inquiry | Site database and email | Set a period, then delete |
| Customer account | Name, mobile, address, order history | Fulfil orders | Database | While the account is active, then a set period |
| Payment | Card details | Complete payment | With the payment gateway only | Never stored by you |
| Analytics | Device identifiers, pages, approximate city | Improve the site | With the analytics provider | Per provider settings |
| Mobile app | Push token, location | Notifications and delivery | Server and push provider | Until uninstall or account deletion |
| Cookies | Session and advertising identifiers | Login and advertising | Visitor's browser | Depends on the cookie type |
Once the table is filled in, you will usually find data you never needed. Remove it from your forms before anything else.
Privacy policy requirements in Saudi Arabia: what to include
A privacy policy is not text copied from another website; it is an accurate description of what actually happens in your system. The inventory above is its raw material. Make sure it answers these questions in plain language:
- Who is the entity responsible for the data, and how can a data subject contact it?
- What data do you collect, and from which sources?
- What is the purpose of each type, and on what basis do you collect it?
- Who do you share data with, such as couriers, payment gateways and messaging providers?
- Is data transferred outside the Kingdom, and where to?
- How long do you keep it, and how is it deleted?
- What rights does the data subject have, and how do they exercise them?
Link the policy in every page footer, next to every form that collects data, and inside the app's settings. Write it in Arabic first, then in English if your site is bilingual.
Consent, purpose and data minimisation
The law ties data collection to a specific purpose that the person is told about at the time of collection. In practice that means:
- Notice at the point of collection: a short line under each form explaining why you ask for the data, with a link to the policy.
- An unticked consent box where consent is the basis you rely on.
- Separate marketing consent: do not bundle acceptance of terms with promotional messages, and give an easy way to opt out.
- Just-in-time app permissions: do not request location or camera access when the app opens; request it when the user reaches the feature that needs it.
- Minimisation: if a mobile number is enough, do not ask for date of birth and national ID.
From obligation to build task: the implementation table
This is the table we recommend attaching to any development contract, so privacy never stays a vague clause without an owner:
| Obligation | Technical task | Owner |
|---|---|---|
| Transparency | Privacy policy page and a notice on every form | Lawyer for the text, developer for implementation |
| Consent and purpose | Separate consent boxes, logging the time and version of consent | Developer |
| Minimisation | Review form fields and remove what is unnecessary | Business owner and developer |
| Retention and deletion | A scheduled job that deletes or anonymises data after the set period | Developer |
| Access control | Role-based permissions and two-factor login for the admin panel | Developer and management |
| Encryption | Mandatory HTTPS, encryption of sensitive fields, hashed passwords | Developer |
| Logs | A log of who viewed, edited or exported personal data | Developer |
| Payment data security | Use the gateway's hosted payment page or hosted fields | Developer and payment gateway |
| Data subject rights | Request form, account data export, in-app account deletion | Developer and customer service |
| Breach response | Monitoring, alerts, a written plan and a named contact | Maintenance team and management |
On payments specifically: never store card numbers on your own server; let the gateway handle them. Our guide to choosing a payment gateway in Saudi Arabia covers the options.
Hosting, vendors and transfers outside the Kingdom
Your site does not run alone. There is cloud hosting, an email provider, an SMS provider, analytics, a push notification service and perhaps a support desk tool. Any of them may store your customers' data in another country. The PDPL places conditions on transferring data outside the Kingdom, so find out where each vendor hosts data, keep a data processing agreement with each, and review with your lawyer whether the transfer is permitted in your case.
Sometimes the simplest answer: do not send the data at all
Sometimes the best data protection is not collecting the data. In Waraqa, the Arabic PDF editor we built for the web, Windows and Android, processing happens locally on the user's device, so documents are not uploaded to a server and no account is needed. Not every product can work this way, but the question is worth asking at the start of every project: does this data really need to pass through our servers?
Breach response and data subject requests
The law requires you to report personal data breaches, and the implementing regulations set a short deadline for doing so; confirm the current timeframe with SDAIA. You cannot meet a short deadline if you do not know a breach has happened. That is why you need server monitoring, alerts on suspicious login attempts, encrypted backups and regular security updates, which is what our technical maintenance service covers after launch.
A five-step breach plan
- Contain: disable the compromised account, vulnerability or leaked key.
- Assess: which data, how many people, since when.
- Notify the competent authority and affected individuals as the law requires.
- Fix the root cause and document it.
- Hold a post-incident review and update the plan.
For data subject requests, such as access to their data, correction or destruction, create a clear path: a form on the site, a button in the app settings, and a named staff member who responds within a defined time. Remember that Apple and Google require apps that allow account creation to offer account deletion. If you are looking for a team to build all this from the start, our guide to choosing an app development company in Saudi Arabia lists what to ask.
Operating in the UAE too: UAE PDPL, DIFC and ADGM
In the UAE, Federal Decree-Law 45 of 2021 on personal data protection is in force, while the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) apply their own data protection regimes. The good news is that most technical tasks in the table above serve you in both countries; what differs is the legal text and some procedural details, which is your lawyer's job in each jurisdiction.
If your project is new, building these requirements in from day one costs far less than retrofitting them later, and it is a standard part of our web development work.
Frequently asked questions
Does a small website with only a contact form need to comply with the PDPL?
Usually, yes, because a name, mobile number and email are personal data. But compliance in that case is simple: a clear privacy policy, a short notice under the form, asking only for the minimum, secure storage and a defined retention period followed by deletion. You need clarity and someone responsible, not complex systems.
What should a privacy policy for a Saudi website include?
The responsible entity and how to contact it, the data you collect and its source, the purpose of each type, who you share it with, whether it leaves the Kingdom, how long you keep it, and the data subject rights and how to exercise them. Ideally a lawyer drafts it, based on a real inventory of your site data.
Does the Saudi PDPL prevent hosting my website outside the Kingdom?
Not outright, but it sets conditions on transferring personal data outside the Kingdom. Find out where each vendor stores your data, including hosting, email, analytics and messaging, keep a data processing agreement with each, and review with your lawyer whether the conditions affect your case before making the final choice.
What should I do if customer data from my site or app is breached?
Contain it immediately by closing the vulnerability or disabling the compromised account, then assess which data and how many people were affected. Notify the competent authority and affected individuals as the law requires, confirming the current deadline with SDAIA. Then fix the root cause, document what happened and update your response plan.
Build privacy in, not on
Building a new website or app in Saudi Arabia, or want to review what you already have before a client or regulator asks? Send us a description of your system and the data it collects, and we will turn the privacy requirements into a clear technical task list you can deliver in phases.
