GDPR vs Saudi PDPL: what transfers, and what does not

If you run a mature GDPR programme, most of the substance carries over to the Saudi Personal Data Protection Law - but the transfer rules, registration duties and the scope of certain rights do not. Treating the PDPL as "GDPR with different names" is the fastest route to a compliance gap.

What carries over almost directly

• Records of processing. Your GDPR ROPA is the right artefact; extend it to cover Saudi processing.
• Privacy notices. Same purpose and largely the same content - though Arabic language provision matters in the Kingdom.
• Security obligations. Both require appropriate technical and organisational measures. Your ISO 27001 evidence serves both.
• Processor contracts. Both require binding terms with vendors processing on your behalf.
• Purpose limitation, minimisation and retention. Substantially aligned principles.
• Impact assessments for higher-risk processing.

Where they genuinely differ

Cross-border transfers

The biggest practical gap. The GDPR offers a familiar toolkit - adequacy decisions, Standard Contractual Clauses, binding corporate rules. The PDPL frames transfers outside the Kingdom more tightly, with its own conditions and assessment expectations, and some sectors carry data localisation requirements. An SCC in place for GDPR purposes does not automatically satisfy the PDPL. Map every flow leaving the Kingdom - including backups, replicas and support access - and check it against Saudi requirements specifically.

Rights

• Erasure. The GDPR grants a broad right to be forgotten with defined exceptions. The PDPL frames it more narrowly around destruction when the purpose ends.
• Portability. The GDPR has an explicit portability right. The PDPL allows individuals to obtain a copy of their data in a readable format, which is related but not identical.
• Objection and automated decisions. The GDPR has detailed provisions on profiling and solely automated decisions; treat the PDPL position as requiring separate analysis rather than assuming parity.

Regulator interaction

The PDPL involves registration and notification duties toward the regulator that differ from the GDPR model, where the emphasis sits on accountability and record-keeping rather than routine registration. Confirm the current SDAIA expectations - this is an area where guidance has evolved.

Both apply extraterritorially

Neither law stops at its border. The GDPR captures organisations offering goods or services to people in the EU or UK, or monitoring their behaviour. The PDPL captures entities outside the Kingdom processing the personal data of residents. A company selling into both markets is realistically subject to both, regardless of where it is incorporated.

The efficient approach is a single privacy control set with jurisdiction-specific overlays - one ROPA, one rights process, one breach process, with the transfer analysis and notification routes handled per regime.

A practical gap-closing sequence

1. Extend your ROPA to cover Saudi processing activities and identify the data subjects involved.
2. Map every cross-border flow out of the Kingdom and assess it against PDPL requirements specifically.
3. Review your lawful bases - consent carries greater weight under the PDPL than in many GDPR programmes.
4. Adjust your rights-handling procedure for the differences in erasure and copy provision.
5. Confirm registration or notification obligations with the regulator.
6. Provide Arabic-language privacy notices.
7. Reuse your ISO 27001 and 27701 security evidence across both regimes.

Key takeaways

• Security, records, notices and processor terms transfer well from GDPR to PDPL.
• Cross-border transfer mechanisms do not transfer - assess them separately.
• Erasure and portability differ in scope; registration duties differ in kind.
• Both apply extraterritorially, so many organisations are subject to both.