Can website data leave Saudi Arabia under the PDPL?

Yes, under Article 29 and SDAIA's Regulation on Personal Data Transfer outside the Kingdom: to a country with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses or binding corporate rules, within the exceptions the regulation sets. Each transfer must be limited to the minimum data needed.

For a website, analytics and advertising platforms that process visitor data outside Saudi Arabia are transfers too. A transfer must not harm national security or the Kingdom's vital interests, and transfers abroad belong in the record of processing SDAIA can ask for (Article 31).

Read the amended text. Guides written from the 2021 version list a prison term of up to one year for transferring data abroad unlawfully. The amended text SDAIA publishes has no such penalty: the only prison term left is for disclosing sensitive data with intent to harm or for personal gain (Article 35).