What must a privacy policy include under the Saudi PDPL?

It should be in Arabic and explain what the PDPL lets people ask about: the legal basis and purpose of processing, and how to see their data, get a copy, have it corrected or destroyed, and withdraw consent. It should also match your record of processing: purposes, who receives the data, transfers abroad and retention periods.

Publishing an Arabic privacy policy is one of the six steps for implementing the PDPL on a website. The policy explains; it does not replace consent. Analytics and advertising tags normally need the visitor's explicit, informed consent, asked for each purpose before they run (Implementing Regulation, Article 11).

Give people one way to make a request, since you have 30 days to answer, and name the vendors that receive data for you. Each time you add a tag, an app or a vendor, the record of processing changes (Article 31), and the policy should change with it.