Technology & Data Privacy & Cybersecurity Services in Jeddah

Technology, data protection & cybersecurity in Jeddah: PDPL fines can reach SAR 5 million

The Personal Data Protection Law (issued by Royal Decree M/19) came into full effect in September 2024 under the Saudi Data and AI Authority (SDAIA), covering any business processing personal data of individuals within the Kingdom (name, phone number, email, location, photo) regardless of business size, with no exemption for small businesses.

Looking for Technology & Data Privacy & Cybersecurity Services in Jeddah? This lawyer directory lists independent lawyers who handle this area and can put you in touch with one in Jeddah. Browse the full lawyer directory or compare other legal services in Saudi Arabia.

The data controller's basic obligations

Obtaining explicit consent from the data subject before processing, appointing a data protection officer in high-risk cases, conducting a Data Protection Impact Assessment (DPIA) before high-risk processing, and maintaining accurate records of every processing activity including data type, processing purpose, legal basis, and retention period.

Breach reporting: a strict 72-hour deadline

Upon any breach, leak, or unlawful access to data, SDAIA must be notified within 72 hours maximum of learning of the incident, with affected data subjects notified if the incident is likely to cause them harm. Exceeding this deadline is a violation separate from the breach itself.

Fines: reaching SAR 5 million per violation

Violations can expose the business to a fine reaching SAR 5 million depending on the violation's severity and impact, with imprisonment in cases of disclosing sensitive data with intent to harm. The law also applies cross-border, meaning foreign bodies processing Saudi residents' data may be subject to its provisions.

Our technology, data protection, and cybersecurity services

• Assessing your business's compliance with the Personal Data Protection Law (PDPL)
• Drafting privacy policies and data collection notices compliant with the law
• Preparing a data breach response plan within the 72-hour deadline
• Representing businesses in SDAIA investigations or alleged violations

How we start

1. Send us a description of the data your business processes over WhatsApp
2. The lawyers assess compliance gaps and determine required actions
3. The lawyers draft the necessary policies and follow up their implementation

For a data protection compliance assessment in Jeddah, contact us on WhatsApp.

Related links