Saudi Arabia’s data protection law enters into force

The final Implementing Regulations are generally business-friendly and bring the law closer to the EU GDPR. By Brian Meenagh and Lucy Tucker of Latham & Watkins.

The Saudi Data & AI Authority (SDAIA) recently issued the final Implementing and Transfer Regulations for the upcoming Personal Data Protection Law (PDPL), the first comprehensive data protection law in Saudi Arabia. This follows the publication of consultation drafts of the Implementing and Transfer Regulations in April 2023 (the Consultation Draft). The PDPL was issued under Royal Decree No. M/19 on 16 September 2021, and amended pursuant to Royal Decree No. M/148 on 27 March 2023.

The PDPL came into force on 14 September 2023; however, we do not expect enforcement activities until mid-September 2024 because its preambles include an additional one-year transition compliance period.

Continue Reading

International Report subscribers, please login to access the full article


If you wish to subscribe, please see our subscription information.