September 20, 2024

PDPL Fines: What Triggers Them and How to Avoid Paying One

SAR 5M sounds abstract until you know the exact violations that trigger it. Here's the full fine schedule and the kinds of cases SDAIA is actually enforcing.

The fine tiers at a glance

Enforcement under the Personal Data Protection Law (PDPL) is organized into four fine tiers, each tied to a specific category of violation. Knowing which tier your exposure falls into is the first step in building a compliance plan that holds up under scrutiny.

What triggers the SAR 5M maximum

The SAR 5M ceiling is reserved for the most serious breaches: processing personal data without a lawful basis, failing to honor data subject rights, maintaining inadequate security measures that lead to a breach, and failing to register as a controller on the National Data Governance Platform. Early enforcement decisions have generally involved several of these together rather than a single isolated failure.

Sensitive data sits in its own tier

PDPL treats sensitive personal data as a protected category: health records, biometrics, genetic data, religious beliefs, and criminal history. Mishandling this data carries a SAR 3M fine, plus up to 2 years in prison for intentional disclosure. Pharmacies, clinics, fitness apps, and religious organizations are the most directly exposed.

Cross-border transfers: the quiet fine

The SAR 1M cross-border fine is the one most businesses overlook. Every time data syncs to a foreign cloud provider — Stripe (US), HubSpot (US), MailChimp (US), Salesforce (US), even Google Workspace without specific residency settings — personal data leaves Saudi Arabia. Absent explicit authorization, an adequacy determination, or binding contractual safeguards, each transfer is a violation.

The answer is not to abandon cloud tools. Map your data flows, document the lawful basis for every transfer, and use KSA-region infrastructure wherever it is available.

Criminal liability is real

Alongside administrative fines, PDPL carries criminal penalties for specific acts: up to 2 years in prison for intentional disclosure of sensitive data, and up to 1 year for unauthorized cross-border transfer. These penalties attach to the individuals who commit the act, not only to the company. It is the main reason most Saudi businesses are now appointing a designated Data Protection Officer.

What SDAIA is actually enforcing

The first wave of enforcement decisions points to a clear pattern. SDAIA is not hunting for exotic violations. It is checking the fundamentals: missing controller registration, absent consent logs, no breach response plan, no process for handling data subject requests. Companies are being fined for missing documentation, not for sophisticated privacy failures.

The practical conclusion is straightforward. The highest-return compliance work available right now is getting the basics in order:

Register on the National Data Governance Platform
Document your data flows and the lawful basis for each one
Set up consent logging
Write a 72-hour breach response runbook

Walk into an audit with those four things in hand and you are ahead of most of the Saudi market.