October 12, 2024

Thermal Receipts: The Easiest PDPL Violation in Saudi Retail

Paper receipts are the cheapest way to get a SAR 5M fine in the Kingdom. Here's exactly what makes them the easiest PDPL violation SDAIA can find.

What is actually printed on that slip

A typical Saudi thermal receipt carries the merchant name, the transaction amount, the VAT breakdown, the ZATCA QR code and, most importantly, customer information. A phone number taken verbally at the till. A name added for loyalty points. A line captured for warranty purposes. Purchase history that ties this transaction to everything the customer has bought before.

Every one of those customer details is personal data under the Personal Data Protection Law (PDPL). That makes the receipt a personal data record, governed by PDPL rules on consent, retention, transfer and deletion.

Seven things that break the moment you print

Consent is undocumented. A phone number given at the counter leaves no record of what the customer agreed to, or when.
Retention has no limit. Paper sits in a drawer or a shoebox until someone decides to throw it out.
Deletion is impossible in practice. You cannot reliably find and destroy one customer's data across thousands of printed slips.
There is no audit trail. Nothing shows who accessed the data, when, or why.
Data subject rights cannot be honoured. Access, correction and erasure requests have no mechanism behind them.
Access control does not exist. Anyone behind the counter can read, photograph or remove the paper.
Transfers are invisible. Data moving between a point of sale and a payment processor is untracked and unverifiable.

Why SDAIA looks here first

When SDAIA's enforcement team arrives, the opening question is simple: show me how you handle customer data. If the answer is a stack of thermal paper, the rest of the audit is a formality. There are no records to review, no consent logs to check and no retention policy to assess. The violation is sitting on the counter.

That makes thermal receipts the highest-yield target for enforcement. Any merchant still relying on them represents a near-certain finding, which is why the first 48 enforcement decisions fell disproportionately on retailers and food and beverage businesses running legacy receipt workflows.

What the digital alternative solves

A digital receipt closes all seven gaps. Consent is captured and timestamped at the point of sale. Retention runs automatically, with receipts expiring and deleting on a set schedule. Audit trails are searchable by date, customer or amount. Data subject rights are exercised through a self-serve portal. Role-based access limits who can see what. And when data moves between a point of sale and a payment processor, it stays inside KSA-hosted infrastructure.

The arithmetic behind the switch

A thermal printer costs around SAR 500. Paper rolls cost a few riyals each. A merchant prints thousands of receipts a month. Set against the idea of digital receipt infrastructure, the saving looks real until you do the multiplication. A single PDPL violation can cost SAR 5,000,000. Repeat offences reach SAR 10,000,000. Sensitive data adds SAR 3,000,000. The true cost of staying on thermal is measured by one audit, not by decades of paper savings.

The merchants retiring their thermal printers today are not doing it for sustainability. They are doing it because the numbers stopped adding up.