PDPL Penalties and Enforcement: Fines, SDAIA's 48 Decisions, and Your Cookie Banner

Saudi Arabia's Personal Data Protection Law (PDPL) has been enforceable since 14 September 2024, when its one-year grace period ended. In January 2026 the Saudi Data and Artificial Intelligence Authority (SDAIA) confirmed 48 enforcement decisions. This guide sets out what the penalties are, how enforcement works, what those decisions covered, and what they mean for the consent banner on an e-commerce store.

Penalties are one part of the picture. For what PDPL requires for cookies in the first place, and how to keep proof of consent, start with the pillar guide.

What are the penalties for violating Saudi Arabia's PDPL?

The PDPL has two tracks. On the administrative track, fines reach up to SAR 5 million, doubling to SAR 10 million for repeat violations. On the criminal track, disclosing sensitive personal data with intent to harm or for personal gain carries up to two years in prison and a fine of up to SAR 3 million.

Most businesses will only ever meet the first track. Administrative fines are what apply to everyday compliance failures: processing without a valid legal basis, weak safeguards, or marketing sent without consent. The criminal provision is narrower than it is often presented. It requires intent to harm or personal gain, so a store running an unconsented Meta Pixel faces the administrative track, not prison.

• Administrative fine: up to SAR 5,000,000
• Repeat violations: the ceiling doubles to SAR 10,000,000
• Criminal penalty: up to 2 years' imprisonment and a fine of up to SAR 3,000,000, for disclosing sensitive personal data with intent to harm or for personal gain
• Response window: once formally notified of an alleged violation, an organisation has five days to respond

We have deliberately not cited article numbers. The secondary sources we rely on do not cite them consistently, and we could not check them against the official law text at the time of writing. The authoritative text is published by the Bureau of Experts at the Council of Ministers, linked at the end of this guide.

Who enforces the PDPL?

SDAIA, the Saudi Data and Artificial Intelligence Authority, is the competent authority for the PDPL. It issues the law's implementing regulations and enforces it, and it announced the 48 enforcement decisions in January 2026. Unlike the EU, where each country has its own regulator, Saudi enforcement runs through one central authority.

Is the PDPL being enforced yet?

Yes. The PDPL's grace period ended on 14 September 2024, and enforcement has been live since then. In its 16 January 2026 announcement, SDAIA confirmed 48 enforcement decisions against organisations that violated the law. For Saudi businesses, enforcement is no longer a forecast; it is the current state of the law.

Earlier commentary, including an earlier version of this page, described enforcement as something expected in 2026. That framing is out of date. The grace period that gave businesses time to adapt is over, and the regulator has issued decisions. What remains uncertain is the pace and focus of enforcement, not whether it happens.

PDPL enforcement timeline

• September 2021: Royal Decree M/19 enacts the Personal Data Protection Law
• 14 September 2023: the law comes into force, with a one-year grace period for businesses to comply
• 14 September 2024: the grace period ends and enforcement begins
• 16 January 2026: SDAIA announces 48 enforcement decisions

What did SDAIA's 48 enforcement decisions cover?

SDAIA's January 2026 announcement confirmed 48 enforcement decisions. The violation categories it named include processing personal data without a valid legal basis, unauthorised disclosure, inadequate safeguards, and marketing sent without consent. For online stores the last category matters most, because it is the closest to what an unconsented tracker or promotional message does.

• Processing personal data without a valid legal basis
• Unauthorised disclosure of personal data
• Inadequate safeguards for personal data
• Marketing sent without consent

Two cautions. First, sources describe the period those 48 decisions cover differently, so we do not state one; the safe phrasing is "48 enforcement decisions confirmed in SDAIA's January 2026 announcement". Second, we have not seen SDAIA publish a count per category, so no one can honestly say which category was most common. Be wary of any page, including a vendor's, that claims otherwise.

Read from a store owner's side, the categories become concrete questions. Is there a legal basis for every tracker that fires on the storefront? Does the store pass customer data to a third party, such as an ad platform, without that basis? Are customer records protected? And did every customer who receives a promotional email, SMS or WhatsApp message agree to receive it?

What happens if SDAIA notifies you of a violation?

Once formally notified of an alleged PDPL violation, an organisation has five days to respond. That is too short to build compliance from scratch, so the practical preparation is having evidence ready before any notice arrives: consent records, your privacy policy, records of processing, and a clear account of which trackers run on your site.

Five days is enough to gather documents that already exist. It is not enough to work out, for the first time, which third-party scripts load on your storefront, what each one collects, and whether visitors agreed to it. Treat the five-day window as a reason to keep your records current, not as a deadline to plan around. The evidence worth having on hand:

• Timestamped consent records showing what each visitor chose, and when
• A published Arabic privacy policy that names the PDPL and explains what you collect and why
• A current list of the trackers and third-party tools on your site, and the consent category each belongs to
• Proof that the people on your marketing lists opted in
• A named person who handles data protection requests and contact with the regulator

What does PDPL enforcement mean for an online store's cookie banner?

The cookie banner is where an online store establishes the legal basis for its trackers. Under the PDPL, analytics and advertising tags that collect personal data need a valid basis before they run, and for non-essential tracking that basis is normally consent. A banner that shows a notice while trackers already fire does not provide it.

This is where the enforcement categories meet the storefront. A Meta Pixel or Google Ads tag that fires on the first page view, before the visitor has chosen anything, is processing personal data before any basis exists, and it is sending that data to a third party. A banner fixes this only if it changes what the page does, not just what it shows. A banner that does its job meets six conditions:

• Non-essential trackers stay blocked, or in a denied state, until the visitor chooses
• Visitors can accept analytics while declining marketing, not only accept everything
• Rejecting is as easy as accepting, and consent can be withdrawn later
• The banner, and the policy it links to, are available in Arabic
• Each choice is recorded with a timestamp, so you can show it later
• Google tags receive the choice through Google Consent Mode v2, so they respect it

You can check the first condition yourself in a few minutes. Open your store in a private browser window, open the Network tab in the developer tools, and reload without touching the banner. If requests go to google-analytics.com, facebook.com or similar domains before you click anything, the banner is decoration.

How can a store reduce its PDPL enforcement risk?

Start with what anyone can see from outside: stop trackers firing before consent, publish an Arabic privacy policy that names the PDPL, and record every consent choice. Then close the gaps behind the scenes: a procedure for data subject requests, opt-in proof for marketing lists, and agreements with the vendors that process customer data.

• Scan your storefront to see which trackers fire before consent
• Install a consent banner with an Arabic interface that holds non-essential trackers back until the visitor chooses
• Wire Google Consent Mode v2 so Google tags respect the choice
• Publish an Arabic privacy policy written for the PDPL, not a translated GDPR template
• Keep timestamped consent records
• Confirm opt-in for every marketing email, SMS and WhatsApp list
• Set up a procedure for data subject requests
• Check whether you must register with SDAIA as a controller, and keep records of your processing
• Document any transfer of personal data outside Saudi Arabia

Frequently asked questions

Sources