Saudi Arabia's Personal Data Protection Law (PDPL) is overseen by SDAIA. It came into force on 14 September 2023 and became enforceable on 14 September 2024, and it applies to apps and websites that process personal data of people in the Kingdom. In practice you need: minimal data for a clear purpose, a visible privacy policy, a lawful basis or consent, working user rights, solid security, a breach plan, and controls on transfers outside the Kingdom.
- saudi pdpl compliance checklist
- does saudi pdpl apply to small online stores
- pdpl saudi arabia requirements for apps
- when did saudi pdpl become enforceable
- sdaia personal data protection law summary
What is the Saudi PDPL, and does it apply to your app?
The Personal Data Protection Law (PDPL) is the Saudi law that governs how personal data is collected, used, stored and shared. It is overseen by the Saudi Data and AI Authority (SDAIA). It came into force on 14 September 2023 and became enforceable on 14 September 2024 after a transition period. If your app or website collects names, phone numbers, addresses, emails or order history from people in the Kingdom, this Saudi PDPL compliance checklist is for you.
Many small store and app owners assume the law is aimed at banks and telecoms. In reality, an online perfume store, a home-salon booking app or a contact form on a clinic website all process personal data.
The good news: most requirements are common sense and translate into simple design decisions. Do not collect what you do not need, tell people clearly what you do with their data, protect it well, and let them access it, correct it and ask for deletion. This checklist walks you through it step by step. For the wider Gulf picture, read our guide to data residency and data-protection laws.
Step one: map the personal data your app collects
You cannot protect what you do not know exists. List every place personal data enters your app: sign-up, checkout, payment, contact forms, support chats, notifications, analytics tools and staff spreadsheet exports.
| Data | Why we collect it | Where it is stored | Who can access it | When it is deleted |
|---|---|---|---|---|
| Phone number | OTP sign-in and order updates | App database | System and support team | After account closure plus the needed period |
| National Address | Delivery | Orders table | Shipping team and carrier | After the required order-retention period |
| Name | Invoices and contact | Accounts and invoices | Accounting and support | Per invoice-retention rules |
| Card details | Payment | Payment gateway only | The gateway | Never stored by you |
| Browsing history | Improving the store | Analytics tool | Marketing team | Per the tool's settings |
Pay special attention to sensitive data: health, genetic information, credit data, beliefs, origin and children's data. Plan for it from day one.
The core pre-launch checklist
This list covers what most small and mid-sized apps and stores need. Note what you did and when; documentation is part of compliance.
- 1Define a purpose for each data item
Write down why you collect each item, and do not reuse it for an unexpected purpose without a lawful basis or fresh consent.
- 2Identify the lawful basis
Fulfilling the order justifies delivery data, but marketing messages need separate consent that the customer can withdraw.
- 3Publish a clear privacy policy
Arabic first, visible before data is collected, explaining what you collect, why, who you share it with, user rights and how to contact you.
- 4Make rights work in practice
A page or button to request a copy, correct data or delete the account, with a defined internal response time.
- 5Secure the data
HTTPS everywhere, encryption, strong passwords or OTP, staff permissions by need, and backups.
- 6Review third parties
Payment gateway, carrier, messaging provider, analytics: know what each receives and where it processes it.
- 7Prepare a breach plan
Who detects, who decides, how you notify SDAIA and affected people when required and within the regulatory time frame, and how you document it.
- 8Set retention and deletion periods
Do not keep data forever. Tie each type to a period, then delete or anonymize it.
The easiest data to protect is the data you never collected.
Consent and user rights: what do they look like inside an app?
Legal text alone is not enough; rights must show up in the user experience.
- One checkbox bundling terms, marketing and data sharing
- Marketing checkbox pre-ticked
- English-only privacy policy in a tiny footer link
- Deleting an account requires an email that never gets answered
- No record of who consented and when
- Separate, unticked marketing consent
- Privacy policy link visible at sign-up and checkout
- A My data page to view and edit information
- A delete-account button with confirmation and a tracking number
- Consents logged with date and policy version
If sign-in uses the phone number, explain why you need it and how you will use it. If you message customers on WhatsApp, get their consent for that and give them an easy way to stop. Details in WhatsApp marketing done right.
Security and breaches: what is the reasonable minimum?
The law asks you to take appropriate organizational and technical measures to protect data. Some basics have no excuse, especially in apps built quickly with AI.
- HTTPS and an SSL certificate on every page and API, without exception.
- Encryption of data in transit and at rest, especially sensitive data.
- Role-based access: the shipping clerk sees addresses, not payment history; the accountant does not need everything.
- Never store card data in your database; let the payment gateway handle it.
- API keys outside the code, in secure settings, rotated when anyone leaves the team.
- Daily backups with tested restores, and an audit log of who viewed what.
When a breach happens, time matters. The regulations set when and how you notify SDAIA and when you notify affected individuals. Write a one-page plan now. For a deeper review of AI-built apps, use our security checklist for AI-built apps.
Transfers outside the kingdom and third-party providers
Many tools any app uses (analytics, email, SMS, hosting) may process data outside Saudi Arabia. The PDPL does not ban transfers outright, but it attaches conditions and controls to them, and the transfer regulations were amended in September 2024. So know where your customers' data goes before you connect any service.
| Third party | What it usually receives | Question to ask |
|---|---|---|
| Payment gateway | Name, amount, card details | Is it licensed, and does it handle card data for you? |
| Carrier | Name, phone, National Address | Does it use the data for delivery only? |
| SMS and WhatsApp provider | Phone number and message text | Where are messages processed and for how long are they kept? |
| Analytics | Browsing behavior and device IDs | Can data be reduced or anonymized? |
| Hosting and database | Everything | In which country are data and backups stored? |
Hosting inside the Kingdom or the region is not a blanket requirement for every app, but it is required for some sectors and data classes and preferred by many customers and large buyers, because it simplifies transfer questions. Details in hosting your app's data in Saudi Arabia, and see Fanann hosting.
How to build a privacy-aware app from the start with Fanann
Adding privacy after launch is harder and costlier than building it in. When you describe your app to the Fanann Agent, state your data requirements as explicitly as you describe screens and prices. The agent builds tables, permissions and pages from your description, so the more precise you are, the closer the result is to compliance.
Build a booking app for a home women's salon in Riyadh, Arabic first with RTL layout. Data requirements: 1) Collect only: name, phone number, district and National Address, and appointment time. Do not ask for date of birth or ID number. 2) Sign-in with an OTP to the phone number. 3) The sign-up screen has a visible link to the privacy policy and a separate, unticked checkbox for WhatsApp offers; store the consent date and policy version. 4) A My data page to view and edit details, and a Request account deletion button that creates a request with a tracking number in the admin panel. 5) Roles: manager sees everything, staff see only their appointments and their clients' addresses, accountant sees invoices only. 6) Payment through a gateway with mada and Apple Pay, never storing card details. 7) An audit log of who viewed or edited client data. 8) Automatically delete data from cancelled bookings after a period I set in settings.
Try it in FanannAfter the build, test it yourself: create an account, request deletion, log in as a staff member and confirm they cannot see what is not theirs. Then write your privacy policy using our guide to a privacy policy for a Saudi app.
Key takeaways
- The PDPL has been enforceable since 14 September 2024, and it covers small stores and apps, not just large companies.
- Start with a data map: what you collect, why, where it lives and who can see it.
- Collect the minimum, ask for consent clearly where it is the basis, and keep marketing consent separate from the order.
- User rights (to be informed, access, correction, destruction) need a working path inside your app, not just words.
- This is general information, not legal advice; check SDAIA's guidance and a qualified advisor for your case.
Frequently asked questions
When did the Saudi PDPL become enforceable?
Does the Saudi PDPL apply to small online stores?
Do I need customer consent for everything?
Must my app's data be hosted inside Saudi Arabia?
What should I do if customer data leaks?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “Saudi PDPL checklist for apps and websites” https://fanann.com/en/blog/saudi-pdpl-checklist-apps/ My question: saudi pdpl compliance checklist Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.