Saudi Arabia: cookie and consent rules under the PDPL

What is the Saudi PDPL?

The Personal Data Protection Law was issued by Royal Decree No. M/19 of 9/2/1443H (16 September 2021) and amended by Royal Decree No. M/148 of 5/9/1444H (March 2023) before it took effect. Article 43 set its entry into force at 720 days after publication, which fell on 14 September 2023. Royal Decree M/19 gave controllers a one-year grace period, during which SDAIA did not apply penalties, so the law has been fully enforceable since 14 September 2024. Two instruments complete it: the Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom.

The Competent Authority is the Saudi Data and AI Authority (SDAIA). Council of Ministers Decision No. 98 of 7/2/1443H named SDAIA for an initial two years, with a possible later transfer to the National Data Management Office; SDAIA still supervises the law and its violation committees in 2026. It runs the National Data Governance Platform, where controllers register and file breach notifications.

Who does the PDPL apply to?

Article 2 applies the law to any processing of personal data that takes place in the Kingdom, by any means, including processing of personal data of individuals residing in the Kingdom by any party outside it. A foreign online shop or publisher that tracks Saudi visitors is within that wording. There is no size threshold. Only processing for personal or family use, with no publication to others, is excluded.

Personal data is defined broadly as any data, whatever its source or form, that may lead to identifying an individual directly or indirectly, with a list of examples that ends with any other data of a personal nature. The definition does not mention online identifiers, but a cookie or advertising ID linked to a visitor's profile can identify that person indirectly, so it is safest to treat it as personal data.

Do cookies need consent in Saudi Arabia?

There is no Saudi equivalent of the EU ePrivacy rule on storing information on a device. The answer comes from the PDPL's general rules, which put consent first. Article 5 forbids processing personal data, or changing its purpose, without the data subject's consent, except in the cases the law lists. Article 6 lists them: processing that serves the person's actual interests when contacting them is impossible, processing under another law or a prior agreement with the person, security or judicial needs of a public entity, and the controller's legitimate interest, provided the person's rights are not prejudiced and no sensitive data is processed.

The Implementing Regulation sets the conditions for consent in Article 11:

• it must be given freely and not obtained through misleading methods;
• the purposes must be clear and specific and explained before or when consent is asked;
• it must be documented in a way that allows later verification, for example a register recording the time and means of each consent;
• a separate consent is needed for each processing purpose;
• it must be explicit when sensitive or credit data is involved or when decisions are made solely by automated processing.

Article 12 of the Regulation adds that withdrawing consent must be as easy as, or easier than, giving it, and that processing stops without undue delay after withdrawal. Article 7 of the law forbids making a service conditional on consent unless the service is directly related to the processing.

Legitimate interest is not a shortcut. Article 16 of the Regulation allows it only if the purpose is lawful, the controller's interest does not override the person's rights, no sensitive data is processed, and the processing is within the person's reasonable expectations, and the controller must carry out and document an assessment first. Fraud detection and network security are the examples given. Cross-site advertising profiles are hard to fit within a visitor's reasonable expectations, so they are safest on consent, while strictly necessary cookies can rely on the service the visitor asked for.

Put together, a compliant banner asks per purpose (analytics, marketing, functional), with nothing switched on in advance, a Reject option, and a stored record of each choice, which is the granular consent model of the GDPR. Article 12 of the law also requires a privacy policy available before any data is collected, stating the purposes, the data, the means of collection, processing, storage and destruction, and the person's rights. Direct marketing by email or other personal means needs prior consent and an easy way to stop (Article 25 of the law, Article 29 of the Regulation).

Can data be sent outside Saudi Arabia?

Article 29 of the law allows transfers for listed purposes when they do not harm national security or the Kingdom's vital interests, are limited to the minimum data needed, and the destination offers protection at least equivalent to the PDPL, as assessed by the Competent Authority. Without an adequacy decision, the Transfer Regulation allows transfers under appropriate safeguards: binding common rules, SDAIA's standard contractual clauses, approved certifications or binding codes of conduct, plus specific exemption cases and a risk assessment in some situations. Analytics and advertising tools that process data abroad need one of these bases.

What are the penalties?

Article 36 lets SDAIA's committees issue a warning or a fine of up to SAR 5 million for any violation of the law or its regulations, doubled for a repeat violation to at most SAR 10 million, with an appeal to the competent court. Article 35 punishes disclosing or publishing sensitive data, with intent to harm the data subject or for personal benefit, by up to two years' imprisonment, a fine of up to SAR 3 million, or both. Decisions can be published at the violator's expense (Article 38), and anyone harmed can sue for compensation (Article 40).

Enforcement is under way. On 16 January 2026 the Saudi Press Agency reported that SDAIA's violation committees had issued 48 decisions confirming violations by controllers the previous year, covering unlawful collection and processing, disclosure without legal justification, missing security measures, and advertising and marketing messages sent without consent. The individual decisions and amounts were not published.

How Cookiequiet fits

Saudi Arabia is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan. The preferences center offers separate toggles for functional, analytics and marketing, all off by default, Reject all sits next to Accept all, and the consent log records the date, choice, categories and banner version of each decision, which matches the Regulation's demand for documented consent per purpose. Arabic is not one of the 24 built-in languages: visitors whose browser asks for it see the site's default language, whose strings you can edit. Use the cookie scanner to see which providers your site loads, and compare with the UAE rules if you serve both markets. Not legal advice.