Saudi PDPL Guide for Online Stores: What to Do in 2026

Saudi shoppers hand you their name, phone, address and payment details with every order. The PDPL (Personal Data Protection Law) tells you how to look after them.

It's been fully enforced since September 2024. It also reaches stores outside the Kingdom that sell to Saudi residents.

The good news? It's very workable. A clear privacy notice, honest consent and a few contracts with your apps cover most of it.

Below you'll find each rule in plain English, a worked example and a checklist you can tick off this week. It's part of our Saudi regulations guide.

What is the Saudi PDPL?

The PDPL is Saudi Arabia's main privacy law. It sets out how businesses collect, use, store, share and delete personal data, meaning anything that identifies a person.

For a store, that's names, phone numbers, addresses, emails, order history, chat logs and the cookie IDs your pixels drop.

The regulator is SDAIA (the Saudi Data and AI Authority). It runs the law's online services: the National Register of controllers, breach reporting and a tool that tells you whether you need a data protection officer.

Does the PDPL apply to your store?

Yes, if you sell to people living in Saudi Arabia. Article 2 covers processing inside the Kingdom and processing by any party outside it of data about Saudi residents.

So a Dubai brand, a UK Shopify store and a Shenzhen seller shipping to Riyadh are all in scope.

In PDPL terms, your store is the "controller": you decide why and how data is used. Your apps, couriers and payment gateways are "processors" acting on your behalf. You stay responsible for what they do with your customers' data.

Lawful bases: when do you need consent?

Consent is the default legal basis under the PDPL. But it isn't the only one, and most order data doesn't need it.

Here's how it maps onto a typical store:

• Fulfilling an order. Name, address, phone and payment data rest on the contract with the customer. No checkbox needed.
• Tax and invoices. Keeping invoice records meets a legal obligation.
• Fraud checks and security. These can rest on legitimate interest, though never for sensitive data.
• Marketing, analytics and ad pixels. These need consent.

Valid consent is freely given, specific to one purpose and recorded. A pre-ticked box doesn't count, and neither does "by using this site you agree".

So list your purposes first, then add a consent step only for the ones in that last bullet.

What must your privacy notice say?

Show a privacy notice before you collect data. SDAIA publishes a guideline on what it should contain.

At minimum, cover:

• Who you are and how to contact you.
• What data you collect and why, with the legal basis for each purpose.
• Who receives it: couriers, payment providers, marketing tools.
• Whether data leaves Saudi Arabia, and where it goes.
• How long you keep it.
• The customer's rights and how to use them.

Write it in Arabic and English, and link it from the footer, checkout and every signup form. The trust signals guide shows where Saudi shoppers expect to find it.

Marketing consent: email, SMS and WhatsApp

Marketing is where most stores slip up, and it carries the biggest fines.

Article 25 of the PDPL bans sending advertising through personal channels like email and phone without the recipient's prior consent. It also requires a clear way to stop receiving it.

The Implementing Regulation (Article 28) adds that consent must be specific, freely given and backed by evidence. Opting out must be as easy as opting in, free and honoured straight away.

The published Article 28 still mentions an exception for people you've dealt with before. A 2025 draft proposed removing it, so ask existing customers for opt-in too. Fines reach SAR 5 million per violation and double for repeat offences.

For sender IDs, sending hours and Ramadan timing, see our SMS marketing rules for Saudi Arabia and the UAE.

Customer rights and how fast to answer

Customers have the right to:

• Know what you collect and why.
• Access their data and get a copy.
• Correct data that's wrong or incomplete.
• Have data destroyed once it's no longer needed.
• Withdraw consent at any time.

Act on each request within 30 days. You can extend by up to 30 more days in some cases, but tell the customer why.

Set up a single contact route, such as a privacy email or a form in the customer account, so requests don't get lost in WhatsApp chats.

Data breaches: the 72-hour rule

A breach is any leak, loss or unauthorised access to personal data. Think of a hacked admin login or a courier spreadsheet sent to the wrong group.

If the breach could harm customers, notify SDAIA within 72 hours of becoming aware of it. Use the breach service on SDAIA's portal.

You must also tell affected customers without undue delay when it could harm them. The Saudi E-Commerce Law adds its own 3-day notice to the Ministry of Commerce, so one incident can mean two reports.

Write a one-page playbook now: who decides, who files each report and what you tell customers.

Sending data outside Saudi Arabia

Most stores transfer data abroad without thinking about it. Shopify, Klaviyo, Google Analytics, Meta Pixel and many Chinese ERP tools store data outside the Kingdom.

That's allowed. SDAIA's Regulation on Personal Data Transfer Outside the Kingdom sets the routes:

1. Adequacy: transfer freely to countries SDAIA rates as giving adequate protection.
2. Appropriate safeguards: otherwise, use SDAIA's standard contractual clauses (SCCs), binding common rules for company groups, or certification.
3. Narrow exceptions: for example, when the transfer is needed to perform a contract with the customer.

Large or continuous transfers, and any sensitive data, also need a written transfer risk assessment. Always send only the minimum data each tool needs.

Tool	Where data goes	What to do
Shopify	Outside Saudi Arabia	Check the data processing agreement covers Saudi transfers
Salla / Zid	Saudi platforms; Salla offers Saudi data residency	Processor contract; check where each app you add sends data
Klaviyo, Mailchimp	Usually US	Sign SCCs or confirm adequacy; marketing consent
Meta Pixel, Google Analytics	US and global	Cookie consent first; SCCs or adequacy
Chinese ERP or OMS	China	SCCs plus a transfer risk assessment
Saudi 3PL or courier	In Saudi Arabia	Processor contract with security terms

National Register and data protection officers

SDAIA keeps a National Register of controllers. Registration is mandatory for three groups:

• Public entities.
• Controllers whose main activity is processing personal data.
• Controllers that process sensitive data, such as health or biometric data.

A typical online store isn't in any of them, but it can still register voluntarily. The register accepts Saudi entities and entities outside the Kingdom.

A data protection officer (DPO) is required only in certain cases. Examples are regular, large-scale monitoring of people, or a core business built on sensitive data.

Most small stores won't need one. Use SDAIA's DPO and registration tools on its portal to check in a few minutes.

Worked example: a UK skincare brand selling to Riyadh

Picture a UK skincare brand on Shopify. It ships to Saudi customers through a Riyadh 3PL and runs Klaviyo emails and Meta ads.

Here's its PDPL to-do list:

1. Map the data: checkout, accounts, Klaviyo, Meta Pixel, Google Analytics, the 3PL and the support inbox.
2. Publish the notice: one Arabic and English privacy page naming each tool and the countries data goes to.
3. Fix consent: turn on a cookie banner and add unticked email and SMS boxes at checkout.
4. Cover transfers: check Shopify's and Klaviyo's agreements, and sign SDAIA's SCCs where they fall short.
5. Sign the 3PL: a processor contract with security and deletion terms.
6. Prepare for incidents: a breach playbook and a privacy inbox with a 30-day reply rule.

That's a week or two of focused work, mostly writing and settings. Once it's done, it runs quietly in the background.

PDPL compliance checklist

Saudi PDPL vs UAE PDPL

Selling in both markets? The two laws share a backbone, so one good setup covers most of each.

	Saudi Arabia	UAE
Law	Royal Decree M/19 (2021), amended 2023	Federal Decree-Law 45/2021
Fully enforceable	Since 14 Sep 2024	In force since Jan 2022; regulations pending
Regulator	SDAIA	UAE Data Office
Covers foreign stores
Marketing	Prior opt-in and free opt-out (Art. 25)	Right to object; TDRA opt-in rules for SMS
Breach deadline	72 hours to SDAIA	Immediately; regulations will set the time
Answer data requests	30 days	1 month, extendable
Transfer tools	SDAIA standard contractual clauses	Adequacy list pending; contracts or consent
Maximum fine	SAR 5 million per violation, doubled for repeats	Set by a future Cabinet decision
Free zones	Applies Kingdom-wide	DIFC and ADGM have their own laws

The UAE PDPL guide for online stores covers the Emirates side in full.

Notes for Shopify stores

• Turn on Shopify's built-in cookie banner, or a consent app that blocks pixels until shoppers agree.
• Shopify stores data outside the Kingdom, so list it in your notice as an overseas processor.
• Use separate checkout checkboxes for email and SMS marketing. Our Shopify GCC setup guide walks through the settings.

Notes for Salla and Zid stores

• Salla and Zid are Saudi platforms. Salla offers Saudi data residency, which keeps your core order data local. On Zid, ask support where your store data is hosted and note it in your privacy page.
• The apps you add can still move data abroad. Check each marketing, analytics and chat app before installing.
• Write your own privacy page rather than a generic one. Name your real tools, couriers and contact details.

Notes for foreign and Chinese sellers

• The PDPL applies to you even with no Saudi entity. SDAIA's register has a category for entities outside the Kingdom.
• Customer data sent to an ERP or warehouse system in China counts as a transfer. Sign SCCs and keep a transfer risk assessment on file.
• Share only what each partner needs. Your Saudi courier needs an address and phone, not the full order history.