SAUDI ARABIA Law and Practice Contributed by: Alex Saleh, Asad Ahmad, Shahad Alhumaidani and Omar Halbouni, GLA & Company
submitted to the judge of the Execution Court with jurisdiction over such matters, to ensure their enforce - ability. For sanctions compliance, internal screening is gener - ally feasible, but outward disclosures – especially to foreign public authorities – must rely on a PDPL legal basis and a permitted transfer mechanism and, in reg - ulated sectors (notably financial services), must use KSA-mandated domestic reporting gateways rather. 5.5 Recent Developments Since 2023, there have been no significant changes to KSA’s data protection laws and regulations, with the primary framework still largely governed by the PDPL, which was designed to align with international data protection standards. Nevertheless, the most notable development in KSA’s data protection regime occurred on 14 September 2024, when the PDPL finally became fully enforceable, marking a signifi - cant milestone for businesses operating in KSA. This full enforcement deadline required organisations to ensure compliance with the Law’s provisions, includ - ing implementing robust data protection measures, appointing data protection officers and adhering to strict data transfer requirements. On 27 April 2025, SDAIA launched its third public consultation on the PDPL and its regulations proposing some amend - ments, but as of the time of writing nothing has been finalised.
KSA has shifted to a modern, safeguards-based cross-border regime under the PDPL, with transfers permitted via adequacy, appropriate safeguards or narrow derogations, subject to risk assessment and accountability. The most impactful next step will be publication of an adequacy list further defining the role of a data protection officer.
393 CHAMBERS.COM
Powered by FlippingBook