PDPL compliance is actively enforced in Saudi Arabia. Companies must set a legal basis, secure data, log every access, and report breaches within 72 hours. Business portals hold the most personal data, so they need access control, consent, and audit logs.
PDPL compliance is now a live legal duty for Saudi companies. The grace period ended on 14 September 2024. SDAIA committees already issue penalties. This guide lists what companies must do in 2026. It also shows why business portals carry the most risk.
Portals are where PDPL risk sits. Employee, customer, and supplier portals store names, contact details, contracts, and login histories. One weak permission or missing log can turn a routine system into a reportable breach. The steps below start with the law, then move to portals.
Contents
What Does PDPL Compliance Mean for Saudi Companies?
The Personal Data Protection Law (PDPL) is Saudi Arabia's data protection law. SDAIA, Saudi Arabia's data authority, enforces it. PDPL compliance means meeting its duties. They span consent, security, transfers, breaches, and rights. The law covers any business processing data of people in Saudi Arabia.
Enforcement is active. In January 2026, the Saudi Press Agency reported 48 decisions from SDAIA committees. Each confirmed a violation. One 2026 guide gives companies as little as 5 days to answer a violation notice. General grace periods no longer apply.
What Must Saudi Companies Do for PDPL Compliance in 2026?
1. Confirm a Legal Basis and Valid Consent
Every processing activity needs a lawful basis. Examples are a contract, a legal duty, or legitimate interest. Consent must be explicit and specific. Pre-ticked boxes are invalid. Users must withdraw consent easily. Record who agreed, when, and to what purpose.
2. Register and Appoint a DPO Where Required
Some controllers must register on SDAIA's National Data Governance Platform. That includes public entities, sensitive data processors, and businesses whose main activity is data processing. Check whether the company meets the Data Protection Officer thresholds. If it does, appoint the officer and register the appointment.
3. Secure Data and Log Every Access
The PDPL requires organizational, administrative, and technical safeguards. Regulators have targeted companies that lacked access management, encryption, and audit logging. Use role-based access. Encrypt personal data, including during transfer. Keep logs showing who viewed, changed, or exported each record. Logs serve as evidence.
4. Build a 72-Hour Breach Plan
Article 24 of the Implementing Regulations sets a 72-hour deadline. Controllers must notify SDAIA within 72 hours of learning about a harmful breach. Assign a named owner. Write the playbook and rehearse it. Serious risks also go to affected individuals without delay.
5. Control Transfers and Vendors
Sending personal data abroad needs a lawful ground, safeguards, and often a documented risk assessment. SDAIA published standard contractual clauses for this purpose. Vendor contracts must state PDPL duties. Controllers stay accountable for processors, including cloud and software providers. Audit each vendor.
6. Assess Risk and Keep Records
Keep records of processing activities. Run a data protection impact assessment before launching high-risk tools. Examples include customer profiling and AI systems. Avoid live personal data in test environments. One 2026 guide treats unmasked data in testing as a compliance breach. Mask it first.
7. Answer Requests and Train Staff
People can ask to access, correct, delete, or move their data. Companies must answer within 30 days. Build a request process with an owner and a due date. Train every employee who handles personal data. Document each training session and keep the records.
PDPL and Your Business Portals
Business portals collect personal data by design. Each login creates a record. Each upload adds a document. Each message adds context. Under the PDPL, the company that runs the portal is the controller. That makes portal design a compliance decision, not only an IT choice.
GO-Globe, founded in 2005, builds business portals. They include employee, customer, and supplier portals with access control, consent, and audit logs. Those three features map to PDPL duties. They limit who sees data, record consent, and prove what happened to it.
Employee Portals
An employee portal holds contracts, payroll details, and performance notes. A manager sees their own team only. An employee portal with role-based access and audit logs shows who opened what. AI features in employee portals also call for an impact assessment.
Customer Portals
A customer portal holds contact details, orders, and support history. Consent must be recorded and easy to withdraw. Customers must be able to request their data. A customer portal with built-in consent records and request forms turns those duties into features.
Supplier Portals
Supplier portals store company registrations, bank details, and names of individual contacts. Personal data of supplier staff falls under the PDPL. Limit each supplier to its own records. An AI supplier portal with access control and audit logs keeps that boundary visible.
Portal Hosting
Where a portal runs also matters. Hosting inside the Kingdom keeps storage local and shrinks transfer questions. Web hosting in Saudi Arabia suits portals that hold Saudi resident data. Pair it with encryption and access logs. Local hosting is one layer, not a full answer.
What Happens If a Company Fails PDPL Compliance?
Administrative fines reach up to SAR 5 million. Intentional disclosure of sensitive data can bring up to two years in prison. SDAIA can also suspend data processing. For a portal in daily use, a suspension stops staff, customers, and suppliers cold.
Committees review violations and issue penalties. Reported findings include processing without a valid legal basis and unauthorized disclosure of personal data. Response windows are short. Prepare evidence before any notice arrives. Confirm current rules with legal counsel. This article is general information, not legal advice.
Need a Portal Built to Meet the PDPL?
Start with an audit of your current portals. List who can see what, where consent is stored, and whether logs exist. Then talk to GO-Globe about an AI portal in Riyadh. Ask for access control, consent, and audit logs from the first screen.
Frequently Asked Questions
What is PDPL compliance?
PDPL compliance means meeting the duties in Saudi Arabia's Personal Data Protection Law. Those duties cover legal basis, consent, security, transfers, breach reporting, and data subject rights. SDAIA enforces them. The duties apply to any organization processing personal data of people in Saudi Arabia.
Who must comply with the PDPL in 2026?
Every organization that processes personal data of people in Saudi Arabia must comply. Location does not matter. A company in Dubai, London, or Karachi is covered. Public bodies, private firms, and foreign companies with Saudi customers all fall under the law.
Do portals need consent records?
Yes, when consent is the legal basis. A portal must record who agreed, when, and for what purpose. Users must be able to withdraw consent. Other legal bases, such as a contract, can cover some processing. Check the basis for each purpose.
Does the PDPL apply to employee data?
Yes. Employee data is personal data. Payroll, contracts, and performance records fall under the PDPL. Companies need a legal basis and security controls. They also need a way to answer access requests within 30 days. A portal can enforce those controls.
How high can PDPL fines go?
Some guides report higher fines for repeat offenses. The confirmed ceiling for administrative fines is SAR 5 million. Criminal penalties apply to intentional disclosure of sensitive data. Beyond fines, SDAIA can suspend data processing. Legal counsel can confirm the current penalty scale for your case.
