PDPL and data collaboration

RegulationPublished 24 October 2026

Saudi Arabia's Personal Data Protection Law (PDPL) sets the rules for collecting, using and sharing personal data, and organisations have had to comply since September 2024. Working with partners on aggregate answers, rather than exchanging customer lists, makes many of its duties easier to meet.

In this article

01What the PDPL is
02Key ideas
03Sharing data with partners
04Individuals' rights
05Breaches and penalties
06How clean rooms help
07Before your next data partnership

01What the PDPL is

The PDPL is Saudi Arabia's main data protection law. It was issued by Royal Decree in 2021, amended in 2023, and came into force on 14 September 2023, with a one-year period to comply that ended on 14 September 2024.

It applies to the processing of personal data about individuals in the Kingdom, including by organisations based outside it. The Saudi Data & AI Authority (SDAIA) supervises it, and implementing regulations set out the detail, including rules on transferring data outside the Kingdom.

02Key ideas

Personal data: any data that can identify a person, directly or indirectly, including identifiers such as emails, phone numbers and device IDs.
Sensitive data: categories such as health, genetic, biometric and credit data, among others the law lists, which carry stricter rules.
Controller and processor: the controller decides why and how personal data is processed; a processor acts on its behalf.
Lawful basis: processing needs a basis, such as consent, a contract, a legal obligation or, since the 2023 amendments, a legitimate interest that doesn't override individuals' rights (not available for sensitive data).
Purpose and minimisation: collect only what a stated purpose needs, and use it only for that purpose.

04Individuals' rights

People whose data you process have the right:

to be informed about how their data is collected and used
to access their data and obtain a copy of it
to ask for it to be corrected, completed or updated
to ask for it to be destroyed once it's no longer needed
to withdraw consent, where processing relies on it

05Breaches and penalties

Under the implementing regulations, organisations must notify SDAIA within 72 hours of becoming aware of a personal data breach, and in some cases inform the individuals affected.

Violations can lead to fines of up to SAR 5 million, which can be doubled for repeat offences. Disclosing sensitive data in breach of the law with intent to harm can lead to imprisonment of up to two years and fines of up to SAR 3 million.

06How clean rooms help

A clean room doesn't make an organisation compliant on its own, but it changes what a partnership involves:

No customer lists change hands: partners get aggregate answers, which supports minimisation.
Purpose and approvals are on record: each collaboration states what it's for and who approved it.
Small groups are held back: results that could single people out don't come out.
Data stays where it lives: processing in place reduces copies and transfers.
There's an audit trail: you can show what was done with data, by whom and when.

You still need a lawful basis for the data you contribute, and hashed identifiers remain personal data.

07Before your next data partnership

What is the purpose, and is it written down?
What is the lawful basis for each dataset involved?
Does any data leave your environment, or the Kingdom?
Will the partner receive records, or only aggregates?
Who approves each use, and where is that recorded?
How will you answer a rights request, or a breach?

This article is general information, not legal advice. For decisions about your own processing, consult a qualified adviser.

Keep reading

GovernanceSet roles, a minimum group size every collaboration starts from, approvals for what goes out, and a full audit trail, the way the PDPL expects.Trust centerHow EleeN protects data: hashing, aggregate answers, minimum group sizes, audit trails, SDAIA certification and Saudi Arabia's PDPL.What is a data clean room?What a data clean room is, how two organisations use one to answer shared questions without seeing each other's records, and when to use one.

Get started

Review your next partnership against the PDPL. Purpose, consent and approvals, each on record.

Tell us about the collaboration you're planning, and we'll walk through how EleeN keeps each step on record.

Book a call How Governance works

What happens next

[01]A call about your data and goals
[02]Your team connects one source
[03]Start with an audience, the marketplace or a partner

Try it

Minimum group size50

Shown
Held back

5of 22

Groups held back

Example figures only.

01What the PDPL is

02Key ideas

Personal data: any data that can identify a person, directly or indirectly, including identifiers such as emails, phone numbers and device IDs.

Sensitive data: categories such as health, genetic, biometric and credit data, among others the law lists, which carry stricter rules.

Controller and processor: the controller decides why and how personal data is processed; a processor acts on its behalf.

Lawful basis: processing needs a basis, such as consent, a contract, a legal obligation or, since the 2023 amendments, a legitimate interest that doesn't override individuals' rights (not available for sensitive data).

Purpose and minimisation: collect only what a stated purpose needs, and use it only for that purpose.

04Individuals' rights

People whose data you process have the right:

to be informed about how their data is collected and used

to access their data and obtain a copy of it

to ask for it to be corrected, completed or updated

to ask for it to be destroyed once it's no longer needed

to withdraw consent, where processing relies on it

05Breaches and penalties

Under the implementing regulations, organisations must notify SDAIA within 72 hours of becoming aware of a personal data breach, and in some cases inform the individuals affected.

06How clean rooms help

A clean room doesn't make an organisation compliant on its own, but it changes what a partnership involves:

No customer lists change hands: partners get aggregate answers, which supports minimisation.

Purpose and approvals are on record: each collaboration states what it's for and who approved it.

Small groups are held back: results that could single people out don't come out.

Data stays where it lives: processing in place reduces copies and transfers.

There's an audit trail: you can show what was done with data, by whom and when.

You still need a lawful basis for the data you contribute, and hashed identifiers remain personal data.

07Before your next data partnership

What is the purpose, and is it written down?

What is the lawful basis for each dataset involved?

Does any data leave your environment, or the Kingdom?

Will the partner receive records, or only aggregates?

Who approves each use, and where is that recorded?

How will you answer a rights request, or a breach?

PDPL and data collaboration

01What the PDPL is

02Key ideas

03Sharing data with partners

04Individuals' rights

05Breaches and penalties

06How clean rooms help

07Before your next data partnership

Go further. Related pages and explainers.

Review your next partnership against the PDPL. Purpose, consent and approvals, each on record.

01What the PDPL is

02Key ideas

03Sharing data with partners

04Individuals' rights

05Breaches and penalties

06How clean rooms help

07Before your next data partnership

Go further. Related pages and explainers.

Review your next partnership against the PDPL. Purpose, consent and approvals, each on record.