Saudi Arabia’s Personal Data Protection Law (PDPL) has been fully in force since 14 September 2024, and the Saudi Data and Artificial Intelligence Authority (SDAIA) is now actively enforcing it. By mid-January 2026, SDAIA had announced 48 enforcement decisions across different sectors. Fines can reach SAR 5 million, and can be doubled for repeat offences.
Most businesses think of data protection as an HR or IT matter. But for many, the website is where most personal data comes in: contact forms, bookings, newsletter sign-ups, online orders, live chat and WhatsApp buttons.
A practical website checklist
- A clear privacy notice, in Arabic and English, that explains what you collect, why, how long you keep it and who you share it with.
- Collect only what you need. Does your contact form really need a date of birth or ID number? Every extra field is extra risk.
- Consent that means something. Marketing sign-ups should be a clear, unticked opt-in, and it should be as easy to unsubscribe as it was to sign up.
- Cookies and tracking. Know which tools (analytics, ads pixels, chat widgets) collect data on your site, and tell visitors.
- Secure forms. HTTPS everywhere, spam protection, and enquiries sent securely, not left sitting in an unprotected inbox or spreadsheet.
- Know where the data lives. Hosting, email, CRM and form tools may store data outside the Kingdom. The PDPL has specific rules on transfers, so check them for your situation.
- A plan for when things go wrong. Keep software updated, and know who does what if there’s a data breach. The law includes notification duties to SDAIA and to the people affected.
- Handle requests. People can ask what data you hold about them, or ask you to correct it. Make sure you can find it.
Why “paperless” helps
Paper forms, photographed IDs sent over chat and spreadsheets emailed around the office are hard to secure and impossible to track. Moving to proper online forms, with data going straight into one secure system, makes it much easier to know what you hold, who can see it and when to delete it.
How Web Solutions can help
We build websites with privacy in mind from the start: lean forms, spam protection without clutter, secure handling of enquiries, bilingual privacy pages you can adapt with your adviser, and hosting and software kept up to date. We’ll also review your current site and tell you what data it’s collecting, including from third-party tools you may have forgotten about.
This article is general information, not legal advice. Please check your obligations with a qualified adviser.
Want a quick privacy check of your website?
We’ll review your forms, tracking tools and hosting, and send you a short list of fixes.