Data Privacy & Digital Rights

Saudi Arabia entered a new data-rights era when the Personal Data Protection Law (PDPL) entered full enforcement on 14 September 2024, after a 1-year grace period from the initial enforcement date of 14 September 2023. The PDPL — issued by Royal Decree M/19 of 16 September 2021 and amended by Royal Decree M/148 of 2023 — is the Kingdom's first comprehensive data-protection statute. The regulator is the Saudi Data and AI Authority (SDAIA), working with the National Data Management Office (NDMO). The Implementing Regulations were issued 7 September 2023; the Regulation on the Transfer of Personal Data Outside the Kingdom was replaced by a new version on 1 September 2024.

For non-consensual intimate imagery (NCII), deepfake sexual content, and sextortion, the criminal framework is the Anti-Cyber Crime Law 2007 (Articles 3, 4, 6) and the Anti-Harassment Law 2018 (Royal Decree, defines harassment broadly to include modern-technology channels). Investigation runs through Public Security + Public Prosecution; victims should also use StopNCII.org (for adults 18+ at the time the image was taken) or takeitdown.ncmec.org (for content depicting under-18s) — both free, both work in KSA.