Glossary

PDPL (Saudi Personal Data Protection Law)

نظام حماية البيانات الشخصية السعودي

Saudi Arabia's Personal Data Protection Law (PDPL), effective 2024, governs how businesses collect, store, process, and transfer personal data of Saudi residents. Websites must display an Arabic-language privacy policy, obtain explicit consent for data collection, and implement data breach notification procedures. Non-compliance can result in fines up to SAR 5 million. We configure compliant consent banners and privacy pages as standard on all Saudi-facing projects.

Related terms

GDPR & PDPL Web ComplianceImplementing privacy law requirements on Gulf websites: Saudi Arabia's Personal Data Protection Law (PDPL, enforced 2023) and UAE's DIFC DP Law 2020. Compliance requires a cookie consent banner, privacy policy in Arabic and English, data deletion workflows, and secure storage of customer data. Non-compliant sites risk fines of up to SAR 5 million under Saudi PDPL.
Nitaqat (Saudi Localisation)Saudi Arabia's workforce Saudisation quota system that requires businesses to maintain a minimum percentage of Saudi national employees, enforced by the Ministry of Human Resources. Companies with a high Nitaqat compliance tier receive preferred government service access, while non-compliant firms face visa restrictions. Digital agencies and tech companies operating in Saudi Arabia must factor Nitaqat into hiring plans—it directly affects the cost and feasibility of building local teams versus outsourcing.
Mada Payment GatewaySaudi Arabia's national debit card network and payment gateway, operated by Saudi Payments. Mada is the most widely used payment method for online transactions in the Kingdom—more common than Visa or Mastercard among local consumers. Any e-commerce or service website targeting Saudi Arabia must integrate Mada to avoid losing the majority of local checkout completions. Integration requires a licensed Saudi payment processor such as HyperPay or Moyasar.
ZATCA E-Invoicing (Fatoorah)Saudi Arabia's mandatory electronic invoicing system mandated by the Zakat, Tax and Customs Authority (ZATCA). Phase 2 requires B2B invoices to be issued in real-time XML format, transmitted to the ZATCA portal, and cryptographically stamped. Businesses selling to Saudi customers via their website must generate ZATCA-compliant invoices automatically. We integrate ZATCA API calls into checkout flows for Saudi-facing web projects.

Back to full glossaryExplore our services

Let's build

Need PDPL (Saudi Personal Data Protection Law) for your business?

Our Lahore team delivers for businesses in Saudi Arabia, UAE, and across the Gulf. Fixed price, 2–4 week delivery, 30-day refinement.

Book a free audit Chat on WhatsApp