Under Saudi Arabia's Personal Data Protection Law, a controller may transfer personal data outside the Kingdom only for listed purposes and when conditions on national interest, adequacy and minimisation are met. SDAIA's transfer regulation, issued in August 2024, adds safeguards and a risk assessment for exempt cases.
The summary below comes from one law firm's article, because the regulator's page did not load for me. Check the original texts and SDAIA's current publications with counsel before relying on it.
Key dates
According to that article, the PDPL is Royal Decree M/19 of 16 September 2021, amended by Royal Decree M/148 of 27 March 2023. SDAIA issued the transfer regulations in August 2024 and a risk assessment guideline in February 2025.
Permitted purposes
Article 29(1) allows transfers to perform an obligation under an agreement to which Saudi Arabia is a party, to serve the Kingdom's interests, or to perform an obligation to which the data subject is a party. The regulations add other purposes, including central processing needed for the controller's activities, providing a service or benefit to the data subject, and scientific research.
The three conditions
All of these must be met, per the article:
- The transfer must not prejudice national security or the Kingdom's vital interests.
- The importer must be in a jurisdiction with an adequate level of protection as determined by SDAIA.
- The transfer must follow data minimisation.
The article reports that SDAIA had not published its list of adequate jurisdictions and suggests limiting transfers to those the European Commission treats as adequate. I could not confirm whether the list has since appeared.
Exempt cases and safeguards
A transfer can skip the adequacy or minimisation condition if an appropriate safeguard is used and a risk assessment is done. The safeguards described are Saudi standard contractual clauses in modular form, binding common rules for intra group transfers only, and a certificate of accreditation. The exempt cases include centralised group operations such as HR and billing, a direct service or benefit to the data subject where the importer holds a certificate, and scientific research. For the direct benefit and research cases the article says sensitive data cannot be transferred.
The risk assessment
Under Article 7 of the regulations, the assessment considers the purpose of the transfer, its nature, including processing activities and geographic scope, the safeguards in place, the recipient's ability to protect data at a level no lower than the PDPL requires, and measures ensuring minimisation.
What engineers should do
- Map flows from Saudi data subjects to any system outside the Kingdom, including support access. See how to build a transfer map.
- Tag fields that are sensitive, since some routes exclude them.
- Record the purpose and the route used for each flow.
- Keep the risk assessment with the engineering facts: data fields, regions, encryption and access.
- Re-check when SDAIA publishes updates.
Quick check
Is the Saudi regime the same as GDPR?
No. It has its own purposes, conditions and safeguards. The ideas overlap, such as clauses and group rules, but the details differ.
Sources
This is educational content, not legal advice.
Last reviewed: 19 October 2026.
