Saudi and UAE privacy law questions, answered

Each answer is short, comes first, and cites the law it relies on. The full detail lives in our regulation guides.

Saudi Arabia (PDPL)

Does the Saudi PDPL require cookie consent?Not by name: Saudi Arabia has no law written specifically for cookies. But when a cookie or tracker can identify a visitor, what it collects is personal data under the PDPL, and analytics and advertising tags normally need the visitor's explicit, informed consent before they run. Cookies a site needs simply to work are a different case.Can I use Google Analytics in Saudi Arabia without consent?Normally not. Google Analytics sets cookies that identify a visitor's browser, so under the PDPL what it collects is personal data, and analytics normally needs the visitor's explicit, informed consent before it runs. Google Consent Mode v2 is how Google's tags learn the visitor's choice. Analytics data processed outside the Kingdom also counts as a transfer.What are the fines under the Saudi PDPL?Administrative fines of up to SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation. Separately, disclosing sensitive personal data with intent to harm or for personal gain carries up to two years in prison and a fine of up to SAR 3,000,000. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.What are the Saudi PDPL implementing regulations?They are the rules that put the Personal Data Protection Law into practice: the Implementing Regulation, which details consent, data subject rights, breach notification and the data protection officer, and the Transfer Regulation for data leaving the Kingdom. SDAIA publishes both, with the law, as PDF files in Arabic and English on its laws and regulations page.Do I need a data protection officer in Saudi Arabia?Only in three cases set by the PDPL Implementing Regulation (Article 32): when a public entity processes personal data at large scale, when your core activities require regular and systematic monitoring of people, or when they rest on sensitive data. An employee or an outside contractor can fill the role.Is implied cookie consent valid in Saudi Arabia?Not for analytics and advertising tags. Under the PDPL, the legal basis for those tags is normally the visitor's explicit, informed consent, given separately for each purpose and documented so it can be verified later. A notice that treats continued browsing as agreement records no choice for any purpose, and leaves the website with nothing to show.Are cookies personal data under the Saudi PDPL?When they can identify a visitor, yes. Saudi Arabia has no law written for cookies, so the PDPL governs them: a cookie or tracker that identifies a visitor, directly or indirectly, collects personal data. The website then needs a legal basis before the tag runs, and for analytics and advertising tags that is normally explicit, informed consent.What counts as valid consent under the Saudi PDPL?Consent given separately for each purpose, after that purpose is explained, and documented so it can be verified later, with the time and the means (Implementing Regulation, Article 11). It can be withdrawn at any time, and it cannot be made a condition of a service unless the service depends on that processing.Can I use legitimate interest under the Saudi PDPL?In some cases. The amended PDPL allows processing for the controller's legitimate interest, but never for sensitive data. Consent remains the default legal basis, though, and for analytics and advertising tags on a website the basis is normally the visitor's explicit, informed consent, not legitimate interest.Does the Saudi PDPL apply to small businesses?Yes. The PDPL applies to any organisation, public or private, domestic or foreign, that processes personal data of people in Saudi Arabia. Processing by an individual for purely personal or family purposes is outside it. Most small and mid-sized businesses do not need a data protection officer, but they still need someone who owns data protection.Who enforces the Saudi PDPL?The Saudi Data and AI Authority (SDAIA) supervises the PDPL, and SDAIA's committees can issue a warning or a fine of up to SAR 5,000,000, doubling for a repeat violation. The criminal penalty for disclosing sensitive data goes through the Public Prosecution and the courts. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.Do I need separate consent for Google Analytics and the Meta Pixel?Normally yes, because they serve different purposes. The PDPL Implementing Regulation (Article 11) expects a separate consent for each purpose, and analytics and advertising are different purposes. So the banner should let a visitor accept analytics and refuse advertising, or the reverse, and record the answer for each category rather than a single yes or no.Does a cookie banner make my website PDPL compliant?No, not by itself. The banner is the part of the PDPL a visitor sees: it asks before analytics and advertising tags run and records each answer. Behind it, the law expects answers to data requests within 30 days, notice to SDAIA within 72 hours of a harmful breach, a record of processing, and checks on transfers abroad.Is there a free cookie consent banner for Saudi websites?Yes, and the PDPL does not ask you to pay for one. It asks for the result: consent before analytics and advertising tags run, a separate choice for each purpose, a record of each answer, and settings that let visitors withdraw. A free banner that does those things is enough; one that shows a message and stores nothing is not.How much does a cookie consent tool cost in Saudi Arabia?The PDPL sets no price and does not require a paid tool; tools run from free plans to managed services. What the law fixes is the work: consent before analytics and advertising tags run, a separate choice for each purpose, a record of each answer, and a way to withdraw. Compare tools on that first, then on price.Is Shopify's built-in cookie banner enough for the Saudi PDPL?It depends on what your store runs. The PDPL asks for consent before analytics and advertising tags run, a choice for each purpose, and a record of each answer. Shopify's banner governs Shopify's own tools, including its cookies and Shopify Pixels; for pixels added manually or through apps, Shopify says you may need a third-party cookie banner or custom logic.Do Salla and Zid stores need a cookie banner?Yes, if the store runs analytics or advertising tags, such as Google Analytics, Google Ads or the Meta Pixel. The platform does not change the law: under the PDPL those tags normally need the visitor's explicit, informed consent before they run, asked for each purpose, recorded, and open to withdrawal at any time.Does the Meta Pixel need cookie consent in Saudi Arabia?Normally yes. The Meta Pixel is an advertising tag, and when a tag can identify a visitor, what it collects is personal data under the PDPL. Advertising tags normally need the visitor's explicit, informed consent before they run. Because the Pixel does not read Google Consent Mode, it has to be kept from loading until the visitor consents to advertising.Does a cookie banner have to be in Arabic?No Saudi rule says in so many words that a cookie banner must be in Arabic. What the PDPL's Implementing Regulation does require is informed consent: each purpose explained before or when you ask (Article 11). A banner a visitor cannot read explains nothing, so for an Arabic-speaking audience an Arabic banner is how consent becomes informed in practice.Why did my GA4 data drop after adding a cookie banner?Because GA4 now waits for consent. Under the PDPL, analytics normally needs the visitor's explicit, informed consent before it runs, and through Google Consent Mode v2 the analytics_storage signal stays denied until the visitor accepts analytics. Visitors who refuse, or never answer, are no longer measured the way they were before the banner.Can I build my own cookie banner?Yes. The PDPL asks for a result, not a tool: consent before analytics and advertising tags run, a separate, explained choice for each purpose, a record of each answer, and settings that let visitors withdraw. A banner you build has to do all of that; one that shows a message and stores nothing leaves nothing to show.What is the PDPL compliance checklist for a website?Six steps: list the data you collect and the tags you run, publish an Arabic privacy policy, ask consent before analytics and advertising tags run and record it, answer data requests within 30 days, notify SDAIA within 72 hours of a breach that could cause harm, and check every transfer of data outside the Kingdom.What is sensitive data under the Saudi PDPL?Racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric and genetic data used to identify a person; health data; and data showing that one or both of a person's parents are unknown. Processing these carries stricter conditions, and legitimate interest can never be the basis for it.Can website data leave Saudi Arabia under the PDPL?Yes, under Article 29 and SDAIA's Regulation on Personal Data Transfer outside the Kingdom: to a country with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses or binding corporate rules, within the exceptions the regulation sets. Each transfer must be limited to the minimum data needed.How fast must a data breach be reported under the Saudi PDPL?Within 72 hours. The PDPL Implementing Regulation requires notifying SDAIA within 72 hours of becoming aware of a breach that could harm the personal data or the people it belongs to. Those people must be told too, without undue delay and in plain language.What must a privacy policy include under the Saudi PDPL?It should be in Arabic and explain what the PDPL lets people ask about: the legal basis and purpose of processing, and how to see their data, get a copy, have it corrected or destroyed, and withdraw consent. It should also match your record of processing: purposes, who receives the data, transfers abroad and retention periods.What are the 2026 Saudi PDPL draft amendments?Draft amendments to the PDPL Implementing Regulation, which SDAIA opened for public comment on the Istitlaa platform on 6 October 2026. The draft is not in force, and the current Implementing Regulation still applies. Clyde & Co's summary says the draft would require controllers to keep evidence of consent.What does Google Analytics collect when a visitor rejects cookies?It depends on the Consent Mode setup. In basic mode, Google tags do not load until consent is granted, so nothing is sent. In advanced mode, they load with consent denied and send only the consent state and cookieless pings. In neither mode are advertising cookies set for a visitor who declined.Does server-side tracking need consent under the PDPL?Yes. Moving tracking from the browser to your server, through tools such as server-side Google Tag Manager or the Meta Conversions API, does not change the legal basis. The PDPL requires consent for processing personal data wherever it happens, and for analytics and advertising that is normally explicit, informed consent for each purpose.

United Arab Emirates (federal PDPL)

Is a cookie banner mandatory in the UAE?The UAE PDPL, Federal Decree-Law No. 45 of 2021, has no provision written for cookies. But a cookie or tracker that can identify a visitor collects personal data, and processing personal data needs consent unless one of the law's exceptions applies. For analytics and advertising tags, a banner that asks first is the practical way to have that basis.Does the UAE PDPL apply to my website?It applies if your organisation is in the UAE and processes personal data, or if you are outside the UAE and process the personal data of people inside it, for example through analytics on your site. Companies established in the DIFC or ADGM follow those free zones’ own data protection laws instead.What are the fines under the UAE PDPL?The UAE PDPL, Federal Decree-Law No. 45 of 2021, sets no fine amounts. Article 26 leaves the violations and the administrative penalties to a Cabinet decision, which had not been published on the UAE's official legislation portal as of September 2026. A fine figure quoted for the federal law, such as AED 10 million, has no basis in its text.When is consent not required under the UAE PDPL?When one of the exceptions the law lists applies, such as performing a contract or meeting a legal obligation. Consent is the default basis under Federal Decree-Law No. 45 of 2021, and the exceptions are a closed list. Where you rely on consent, it must be specific, clear and unambiguous, and can be withdrawn at any time.Which data protection law applies in UAE free zones?It depends on the zone. Entities established in the DIFC follow the DIFC Data Protection Law No. 5 of 2020, and those in the ADGM follow the ADGM Data Protection Regulations 2021, each with its own regulator. Free zones without their own data protection law fall under the federal UAE PDPL, Federal Decree-Law No. 45 of 2021.Who enforces the UAE PDPL?The UAE Data Office is the supervisory authority for Federal Decree-Law No. 45 of 2021. Controllers report breaches to it, and data subjects can complain to it. Penalty amounts are not yet set: Article 26 leaves the violations and administrative penalties to a Cabinet decision, unpublished as of September 2026. The DIFC and ADGM have their own regulators.Have the UAE PDPL executive regulations been issued?Not as of September 2026. Article 28 of Federal Decree-Law No. 45 of 2021 called for executive regulations within six months of the law's issue, but they had not been published on the UAE's official legislation portal. The law itself has been in force since 2 January 2022.How does the UAE PDPL differ from the GDPR for a website?It follows similar principles, but consent is the default basis for processing, with a closed list of exceptions such as performing a contract or meeting a legal obligation. Much of the detail, including fine amounts, is left to executive regulations and Cabinet decisions that had not been published as of September 2026.Can website data leave the UAE?Yes. Under the UAE PDPL, Federal Decree-Law No. 45 of 2021, personal data can go to countries with an adequate level of protection, and to others under the conditions the law sets, such as contractual safeguards or the data subject's express consent. Entities in the DIFC and ADGM follow their own free zones' laws.How quickly must a data breach be reported under the UAE PDPL?Without undue delay. Under Federal Decree-Law No. 45 of 2021, a controller notifies the UAE Data Office and the affected data subjects of a personal data breach without undue delay. Much of the detail is left to executive regulations, which had not been published on the UAE's official legislation portal as of September 2026.

DIFC

Does DIFC data protection law require cookie consent?It sets explicit rules for it. Regulation 9 of the DIFC Data Protection Regulations treats cookies used for personalisation, analytics or advertising as behavioural advertising: visitors get notice and a chance to refuse on first collection, defaults collect the minimum, buttons are colour-neutral, and pre-ticked boxes, silence or inactivity are not consent.Does a cookie banner need a "Reject all" button?Not by that name, but in the DIFC the choice to refuse cannot be played down. Regulation 9 gives visitors a chance to refuse the first time data is collected for analytics or advertising, and requires clear, colour-neutral buttons that neither promote nor discourage any setting. Pre-ticked boxes, silence and inactivity are not consent.