The Personal Data Protection Law (M/19) doesn't exempt small businesses; any entity collecting personal data about its customers (name, phone number, email, even a photo) is fully subject to the law under the Saudi Data and AI Authority (SDAIA), regardless of activity size or customer count.
Looking for Data Protection & PDPL Compliance Services in Jeddah? This lawyer directory lists independent lawyers who handle this area and can put you in touch with one in Jeddah. Browse the full lawyer directory or compare other legal services in Saudi Arabia.
Explicit consent must be obtained from the data subject before collecting or processing their data, with a clear notice specifically and explicitly defining the collection's purpose, not vague general phrases. Using data for a purpose different from what its owner originally consented to is a separate violation even if the initial consent was valid.
Transferring personal data outside Saudi Arabia needs either an equivalent protection level in the receiving country, or explicit approval from the competent body (SDAIA) on a case-by-case basis, especially for sensitive data. Companies using international cloud services need careful review of where data is actually stored.
For a personal data protection compliance assessment in Jeddah, contact us on WhatsApp.
For related reading, see Healthcare & Medical Lawyers in Jeddah or Energy, Oil & Gas Lawyers in Jeddah.This directory introduces you to independent lawyers. The agreement on services and fees is between you and the lawyer alone.
💬 Connect me with a lawyer on WhatsApp