---
title: PDPL and data collaboration · EleeN
url: https://www.eleenai.com/en/resources/pdpl-and-data-collaboration
language: en
description: How Saudi Arabia's Personal Data Protection Law shapes data collaboration: consent, purpose, records, and working with partners on aggregate answers.
---

1. [Home](https://www.eleenai.com/en)
2. [Resources](https://www.eleenai.com/en/resources)
3. PDPL and data collaboration

# PDPL and data collaboration

RegulationPublished 24 October 2026

Saudi Arabia's Personal Data Protection Law (PDPL) sets the rules for collecting, using and sharing personal data, and organisations have had to comply since September 2024. Working with partners on aggregate answers, rather than exchanging customer lists, makes many of its duties easier to meet.

## In this article

1. [01What the PDPL is](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#what)
2. [02Key ideas](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#ideas)
3. [03Sharing data with partners](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#sharing)
4. [04Individuals' rights](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#rights)
5. [05Breaches and penalties](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#breaches)
6. [06How clean rooms help](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#clean-rooms)
7. [07Before your next data partnership](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#checklist)

In this article

1. [01What the PDPL is](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#what)
2. [02Key ideas](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#ideas)
3. [03Sharing data with partners](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#sharing)
4. [04Individuals' rights](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#rights)
5. [05Breaches and penalties](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#breaches)
6. [06How clean rooms help](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#clean-rooms)
7. [07Before your next data partnership](https://www.eleenai.com/en/resources/pdpl-and-data-collaboration#checklist)

## 01What the PDPL is

The PDPL is Saudi Arabia's main data protection law. It was issued by Royal Decree in 2021, amended in 2023, and came into force on 14 September 2023, with a one-year period to comply that ended on 14 September 2024.

It applies to the processing of personal data about individuals in the Kingdom, including by organisations based outside it. The Saudi Data & AI Authority (SDAIA) supervises it, and implementing regulations set out the detail, including rules on transferring data outside the Kingdom.

## 02Key ideas

- Personal data: any data that can identify a person, directly or indirectly, including identifiers such as emails, phone numbers and device IDs.
- Sensitive data: categories such as health, genetic, biometric and credit data, among others the law lists, which carry stricter rules.
- Controller and processor: the controller decides why and how personal data is processed; a processor acts on its behalf.
- Lawful basis: processing needs a basis, such as consent, a contract, a legal obligation or, since the 2023 amendments, a legitimate interest that doesn't override individuals' rights (not available for sensitive data).
- Purpose and minimisation: collect only what a stated purpose needs, and use it only for that purpose.

## 03Sharing data with partners

Data partnerships are where many PDPL questions arise. Disclosing personal data to another organisation needs a lawful basis and a purpose, the recipient has to protect it, and your records should show what was shared and why.

Transfers outside the Kingdom are restricted: they're allowed only in the cases the law and its transfer regulations set out, with appropriate safeguards.

## 04Individuals' rights

People whose data you process have the right:

- to be informed about how their data is collected and used
- to access their data and obtain a copy of it
- to ask for it to be corrected, completed or updated
- to ask for it to be destroyed once it's no longer needed
- to withdraw consent, where processing relies on it

## 05Breaches and penalties

Under the implementing regulations, organisations must notify SDAIA within 72 hours of becoming aware of a personal data breach, and in some cases inform the individuals affected.

Violations can lead to fines of up to SAR 5 million, which can be doubled for repeat offences. Disclosing sensitive data in breach of the law with intent to harm can lead to imprisonment of up to two years and fines of up to SAR 3 million.

## 06How clean rooms help

A clean room doesn't make an organisation compliant on its own, but it changes what a partnership involves:

- No customer lists change hands: partners get aggregate answers, which supports minimisation.
- Purpose and approvals are on record: each collaboration states what it's for and who approved it.
- Small groups are held back: results that could single people out don't come out.
- Data stays where it lives: processing in place reduces copies and transfers.
- There's an audit trail: you can show what was done with data, by whom and when.

You still need a lawful basis for the data you contribute, and hashed identifiers remain personal data.

## 07Before your next data partnership

- What is the purpose, and is it written down?
- What is the lawful basis for each dataset involved?
- Does any data leave your environment, or the Kingdom?
- Will the partner receive records, or only aggregates?
- Who approves each use, and where is that recorded?
- How will you answer a rights request, or a breach?

This article is general information, not legal advice. For decisions about your own processing, consult a qualified adviser.

Keep reading

## Go further. Related pages and explainers.

[GovernanceSet roles, a minimum group size every collaboration starts from, approvals for what goes out, and a full audit trail, the way the PDPL expects.](https://www.eleenai.com/en/platform/governance) · [Trust centerHow EleeN protects data: hashing, aggregate answers, minimum group sizes, audit trails, SDAIA certification and Saudi Arabia's PDPL.](https://www.eleenai.com/en/trust) · [What is a data clean room?What a data clean room is, how two organisations use one to answer shared questions without seeing each other's records, and when to use one.](https://www.eleenai.com/en/resources/what-is-a-data-clean-room)

Get started

## Review your next partnership against the PDPL. Purpose, consent and approvals, each on record.

Tell us about the collaboration you're planning, and we'll walk through how EleeN keeps each step on record.

[Book a call](https://www.eleenai.com/en/contact) · [How Governance works](https://www.eleenai.com/en/platform/governance)

What happens next

1. [01]A call about your data and goals
2. [02]Your team connects one source
3. [03]Start with an audience, the marketplace or a partner

Try it

Minimum group size50

- Shown
- Held back

5of 22

Groups held back

Example figures only.

## [Platform](https://www.eleenai.com/en/platform)

- [EleeNID](https://www.eleenai.com/en/platform/identity)
- [Clean rooms](https://www.eleenai.com/en/platform/clean-rooms)
- [Marketplace](https://www.eleenai.com/en/platform/marketplace)
- [Activation](https://www.eleenai.com/en/platform/activation)
- [Governance](https://www.eleenai.com/en/platform/governance)
- [Integrations](https://www.eleenai.com/en/platform/integrations)

## [Solutions](https://www.eleenai.com/en/solutions)

- [Banking](https://www.eleenai.com/en/solutions/banking)
- [Telecom](https://www.eleenai.com/en/solutions/telecom)
- [Retail](https://www.eleenai.com/en/solutions/retail)
- [Media](https://www.eleenai.com/en/solutions/media)
- [Healthcare](https://www.eleenai.com/en/solutions/healthcare)
- [Data providers](https://www.eleenai.com/en/data-providers)

## [Company](https://www.eleenai.com/en/company)

- [Resources](https://www.eleenai.com/en/resources)
- [Contact](https://www.eleenai.com/en/contact)

## Trust & legal

- [Trust center](https://www.eleenai.com/en/trust)
- [Privacy](https://www.eleenai.com/en/legal/privacy)
- [Terms](https://www.eleenai.com/en/legal/terms)

Data collaboration platform, Riyadh.

Al Olaya, King Fahd District, Riyadh 12271, Saudi Arabia

[contact@eleenai.com](mailto:contact@eleenai.com)

- [LinkedIn](https://www.linkedin.com/company/eleen/)
- [X](https://x.com/iEleeNai)

Start with a call

About your data and the partners you'd like to work with.

[Book a call](https://www.eleenai.com/en/contact)

- Certified bySaudi Data & AI Authority (SDAIA)
- PassedData and Privacy Regulatory Sandbox
- Privacy proof of concept withSEHA Virtual Hospital

© 2026 EleeN. All rights reserved.

## Structured data

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Home",
      "item": "https://www.eleenai.com/en"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Resources",
      "item": "https://www.eleenai.com/en/resources"
    },
    {
      "@type": "ListItem",
      "position": 3,
      "name": "PDPL and data collaboration",
      "item": "https://www.eleenai.com/en/resources/pdpl-and-data-collaboration"
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "PDPL and data collaboration",
  "description": "Saudi Arabia's Personal Data Protection Law (PDPL) sets the rules for collecting, using and sharing personal data, and organisations have had to comply since September 2024. Working with partners on aggregate answers, rather than exchanging customer lists, makes many of its duties easier to meet.",
  "datePublished": "2026-10-24",
  "inLanguage": "en",
  "url": "https://www.eleenai.com/en/resources/pdpl-and-data-collaboration",
  "author": {
    "@type": "Organization",
    "name": "EleeN",
    "url": "https://www.eleenai.com"
  },
  "publisher": {
    "@type": "Organization",
    "name": "EleeN",
    "url": "https://www.eleenai.com"
  },
  "image": "https://www.eleenai.com/images/covers/pdpl-and-data-collaboration-1200.webp"
}
```