Cross-Border Data Transfer
Under PDPL, moving personal data outside Saudi Arabia needs explicit authorization, safeguards, or adequacy determination. Unauthorized transfers carry fines up to SAR 1M plus up to 1 year in prison.
Sources
Related terms
PDPL
Saudi Arabia's Personal Data Protection Law. The national framework governing how businesses collect, store, and transfer personal data. In full force since September 2024.
Data Controller
Under PDPL, the entity that decides why and how personal data is processed. Controllers bear primary legal responsibility for compliance and must register on the National Data Governance Platform.
Need help getting PDPL-compliant? Wateer makes it the default.
Talk to Sales