KSA PDPL Fines & Penalties: What Non-Compliance Actually Costs Your Business (2026)
Introduction
Saudi Arabia’s Personal Data Protection Law (PDPL) is no longer a future compliance requirement.
The PDPL entered into force on September 14, 2023, with a corrective period intended to give organizations time to align their practices by September 14, 2024, subject to the rules governing extensions. SDAIA’s current regulatory materials confirm that specialized committees are actively examining complaints and alleged violations and imposing the penalties prescribed by the law.
For businesses processing personal data in Saudi Arabia, the question is no longer simply whether the PDPL applies. It is what can happen when an organization fails to comply.
The consequences can include warnings, administrative fines of up to SAR 5 million, doubled fines for repeat violations, criminal penalties for certain intentional disclosures of sensitive personal data, confiscation of unlawful gains, publication of final decisions, and compensation claims for affected individuals.
What Are the KSA PDPL Fine Amounts?
Under Article 36 of the PDPL, violations not covered by the specific criminal offense in Article 35 may result in a warning or a fine of up to SAR 5,000,000.
The law also allows the fine to be doubled in the event of a repeat violation, provided the resulting amount does not exceed twice the statutory maximum. That means the maximum exposure under Article 36 can reach SAR 10,000,000 for a repeat violation.
Importantly, SAR 5 million is a statutory maximum, not an automatic penalty for every violation. Article 36 requires the violation committee to consider factors including the type and seriousness of the violation and its impact when imposing a warning or fine.
PDPL penalties at a glance
| Violation or consequence | Potential penalty or consequence |
|---|---|
| General PDPL or Implementing Regulation violation | Warning or fine of up to SAR 5,000,000 |
| Repeat general violation | Fine may be doubled, up to SAR 10,000,000 |
| Intentional unlawful disclosure or publication of sensitive personal data for harm or personal benefit | Up to 2 years’ imprisonment, a fine up to SAR 3,000,000, or both |
| Repeat Article 35 offense | The court may double the fine, up to SAR 6,000,000 |
| Unlawful financial gains resulting from a violation | A competent court may order confiscation of the funds obtained |
| Final enforcement decision | A judgment or decision may, depending on the circumstances, include publication at the violator’s expense |
| Damage suffered by an individual | The affected person may seek proportionate compensation for material or moral damage |
The criminal penalty under Article 35 is narrower than the general administrative penalty under Article 36. It applies specifically where an individual discloses or publishes sensitive personal data in violation of the PDPL with the intention of harming the data subject or achieving a personal benefit. The Public Prosecution is responsible for investigating and prosecuting that offense before the competent court.
What Triggers PDPL Enforcement?
Not every compliance failure automatically results in the maximum fine. However, SDAIA’s own guidance identifies a range of practices that organizations should avoid.
Examples include:
- Processing personal data without an established lawful basis
- Collecting more personal data than necessary for the stated purpose
- Failing to provide required information to data subjects
- Improper disclosure of personal data
- Failing to maintain appropriate technical and organizational measures
- Failing to properly handle data-subject rights requests
- Failing to maintain required processing records
- Non-compliant direct marketing practices
- Failing to meet applicable personal data breach notification requirements
SDAIA’s official guidance specifically gives processing personal data without an established lawful basis as an example of a bad data-protection practice. The Implementing Regulations also require controllers to maintain records of processing activities and establish requirements around matters such as legitimate-interest processing, data minimization, data-subject rights, and breach notification.
How SDAIA Enforcement Works
PDPL enforcement is not simply a matter of an automated fine being issued.
Under Article 36, specialized committees established by the competent authority examine violations and can issue warnings or impose fines, taking into account the type, seriousness, and impact of the violation. Decisions issued by the committee may be challenged before the competent court.
SDAIA has also published rules governing the procedures of these violation-review committees. The committees include legal and technical expertise, and SDAIA has confirmed that they are actively examining complaints relating to PDPL violations.
The enforcement process can therefore involve:
- Complaint or identification of an alleged violation
- Request for information, statements, or supporting documentation
- Review and investigation of the alleged violation
- Committee consideration of the case
- Warning or financial penalty where applicable
- Potential referral to the competent court for matters falling under Article 35
- Appeal or challenge through the applicable legal process
- Corrective action and continued compliance
Article 37 also gives authorized employees and workers powers to monitor and inspect violations and allows them to seek assistance from criminal investigation authorities or other competent authorities where necessary. The competent authority may also seize means or tools used in committing a violation until a decision is made.
What Happens Beyond the Fine?
The financial penalty is only one part of the potential exposure.
1. Criminal liability for certain sensitive-data disclosures
Article 35 creates a specific criminal offense for unlawful disclosure or publication of sensitive personal data when carried out with the intention of harming the data subject or obtaining a personal benefit.
The maximum penalty is:
- Up to 2 years’ imprisonment
- Up to SAR 3,000,000 in fines
- Or both
For repeat offenses, the competent court may double the fine, subject to the statutory limit of twice the maximum.
2. Confiscation of unlawful gains
Article 38 allows the competent court to order the confiscation of funds obtained as a result of committing violations, subject to the rights of bona fide third parties.
3. Publication of a final decision
Article 38 also permits the competent court or the relevant violation committee to include publication of a summary of the judgment or decision at the violator’s expense, depending on the type, seriousness, and impact of the violation.
Publication occurs after the judgment or decision becomes final and the applicable appeal period or proceedings have concluded.
4. Compensation claims
Regulatory penalties are not necessarily the end of the matter.
Under Article 40, an individual who suffers damage as a result of a violation of the PDPL or its Regulations may apply to the competent court for proportionate compensation for material or moral damage.
That means an organization may face multiple forms of exposure arising from the same underlying compliance failure.
Why “We’ll Fix It If We Get Flagged” Is Risky
A reactive approach creates several problems.
Repeat violations can increase the financial exposure
For general violations covered by Article 36, the fine may be doubled where the violation is repeated. The maximum therefore can rise from SAR 5 million to SAR 10 million.
Compliance evidence matters
Organizations are expected to maintain documented compliance mechanisms.
For example, the Implementing Regulations require controllers to maintain a written record of personal data processing activities throughout the processing period and for five years after the processing activity ends, with the records kept accurate and up to date and made available to the competent authority when requested.
This makes compliance documentation more than an internal administrative exercise. Organizations should be able to demonstrate how their processing activities comply with the applicable requirements.
Fixing a gap after an investigation is harder
If a business only starts building its compliance records after receiving an inquiry, it may have difficulty demonstrating what controls, assessments, notices, consents, contracts, and processing records were actually in place when the relevant processing occurred.
A more sustainable approach is to maintain compliance evidence continuously.
What Should a Business Have Ready?
For organizations subject to the PDPL, an audit-ready compliance program should typically include documented evidence covering areas such as:
- Personal data inventory and data mapping
- Processing purposes and lawful bases
- Privacy notices
- Consent records, where consent is relied upon
- Legitimate-interest assessments, where applicable
- Data-subject rights procedures
- Records of processing activities
- Data retention and deletion practices
- Technical and organizational security measures
- Processor and third-party arrangements
- Personal data transfer assessments and safeguards
- Personal data breach procedures and records
- Privacy impact assessments where required
- Direct marketing compliance
- Policies, procedures, and employee training
- Evidence of ongoing monitoring and corrective actions
SDAIA’s regulatory framework includes the PDPL, Implementing Regulations, regulations governing transfers outside the Kingdom, and additional policies, standards, rules, and guidance. Organizations therefore need to assess compliance across the applicable framework rather than treating the SAR 5 million figure as the only issue.
How Sahl Helps Reduce PDPL Compliance Risk
Sahl helps organizations move from reactive compliance work toward continuously maintained compliance evidence.
Continuous compliance monitoring
Keep compliance requirements and evidence current rather than reconstructing them when an audit, complaint, or regulatory request arises.
Automated data mapping
Map personal data processing activities, purposes, data categories, and applicable legal bases to create a clearer compliance record.
Consent management
Track consent-related evidence and help organizations identify where consent is being relied upon for processing or marketing activities.
Audit-ready reporting
Maintain structured compliance evidence and reports that can help your team respond efficiently to internal reviews or regulatory documentation requests.
See how Sahl helps with KSA PDPL compliance →
Frequently Asked Questions
For general violations covered by Article 36, the PDPL provides for a warning or a fine of up to SAR 5,000,000. The fine may be doubled for a repeat violation, meaning the statutory maximum can reach SAR 10,000,000. The actual penalty depends on the circumstances of the violation, including its type, seriousness, and impact.
Yes, but the criminal penalty is tied to the specific offense in Article 35. Unlawfully disclosing or publishing sensitive personal data with the intention of harming the data subject or achieving a personal benefit can result in up to two years’ imprisonment, a fine of up to SAR 3,000,000, or both.
The PDPL’s express penalty provisions include warnings, fines, criminal penalties for the Article 35 offense, confiscation, publication of final decisions, and compensation claims. The law does not state in Article 36 that SDAIA can simply shut down a business as a standard PDPL fine. However, other legal or regulatory powers may apply depending on the organization, sector, and circumstances.
Organizations should pay particular attention to lawful basis, transparency, data minimization, disclosure controls, security measures, data-subject rights, processing records, breach response, direct marketing, and international data transfers. SDAIA’s official guidance specifically identifies processing personal data without an established lawful basis as an example of a bad data-protection practice.
No. The PDPL entered into force on September 14, 2023, and SDAIA’s published materials state that organizations were expected to adjust their status by September 14, 2024, subject to the applicable rules concerning corrective-period extensions. SDAIA has subsequently confirmed that regulatory oversight and violation-review activities are underway.
Yes. Article 40 provides that an individual who suffers damage resulting from a violation of the PDPL or its Regulations may apply to the competent court for proportionate compensation for material or moral damage.
Ready to Reduce Your PDPL Compliance Risk?
The biggest PDPL exposure is not simply the headline SAR 5 million figure.
It is having to prove, after the fact, that your organization had the right controls, lawful bases, records, notices, contracts, assessments, and safeguards in place.
Don’t wait for a formal inquiry to discover that your compliance evidence is incomplete.
Sahl helps keep your KSA PDPL compliance evidence continuously organized and audit-ready.
