Saudi PDPL compliance for websites and online stores
For a website, PDPL compliance starts with the tags it runs. A cookie or tracker that can identify a visitor, directly or indirectly, collects personal data, so analytics and advertising tags normally need the visitor's consent first: asked for each purpose separately, recorded, and open to withdrawal at any time. This page sets out what the law and its Implementing Regulation require, and links to SDAIA's own text.
Sep 2024
Enforcement Date
SAR 5M
Max fine · SAR 10M if repeated
All Sectors
Applies To
Implementation
How do you implement the Saudi PDPL on a website or online store?
Implementing the Saudi PDPL on a website takes six steps: list the data you collect and the tags you run, publish an Arabic privacy policy, ask consent before analytics and ad tags and record it, answer data requests within 30 days, notify SDAIA within 72 hours of a breach, and check every transfer of data outside the Kingdom.
The short answer
Is there a cookie law in Saudi Arabia?
There is no Saudi law or regulation written specifically for cookies. Cookies are governed by the Personal Data Protection Law (PDPL): when a cookie or tracker can identify a visitor, directly or indirectly, what it collects is personal data, and the website needs a legal basis before it runs. For analytics and advertising tags, that basis is normally the visitor's explicit, informed consent. So a business website that runs Google Analytics, Google Ads or Meta tags needs a banner that asks before those tags run and records the answer; cookies a site needs simply to work are a different case.
Baker McKenzie's Saudi data handbook reads it the same way: no cookie-specific rule, with PDPL applying to the personal data cookies collect. So a cookie banner in Saudi Arabia is not a formality borrowed from Europe. It's how a website gets the consent PDPL asks for, and how it proves it later. This page is the reference: what the law and its Implementing Regulation say, where to read them, and what they mean for a site. Enforcement and fines get their own page, linked under Penalties.
What a cookie banner in Saudi Arabia has to do, step by stepBaker McKenzie: Saudi Arabia, cookies and online trackingDownload the plain-language PDPL guide in Arabic (PDF)What PDPL is
The Personal Data Protection Law (PDPL) is Saudi Arabia's general data protection law, issued by Royal Decree M/19 of 9/2/1443H (16 September 2021) and amended by Royal Decree M/148 of 5/9/1444H (27 March 2023), before it had ever applied.
It came into force on 14 September 2023, and the one-year grace period for existing processing ended on 14 September 2024. The Saudi Data and AI Authority (SDAIA) supervises it.
The law reaches past the border: it covers processing of personal data of people residing in the Kingdom by a party outside it, so a Dubai agency or a European brand selling into Riyadh is inside it. Consent is the default legal basis, and the Implementing Regulation wants it documented and given separately for each purpose.
The amended text also allows processing for the controller's legitimate interest, never for sensitive data. Fines reach SAR 5,000,000 and can double for a repeat violation, while prison is reserved for disclosing sensitive data with intent to harm or for personal gain.
Enforcement is under way: SDAIA confirmed 48 enforcement decisions in its 16 January 2026 announcement.
PDPL compliance requirements
- 01
Consent for each purpose, kept on record
Explain each purpose before or when you ask, get a separate consent for each one, and keep a record that shows when and how it was given (Implementing Regulation, Art. 11). Consent can be withdrawn at any time, and it cannot be made a condition of a service unless the service depends on that processing.
- 02
Answer requests within 30 days
People can ask for the legal basis and purpose, see their data, get a copy in a clear, readable format, and have it corrected or destroyed. You have 30 days. One extension of up to 30 more is allowed, if you tell the person beforehand and say why.
- 03
Report a breach within 72 hours
Notify SDAIA within 72 hours of becoming aware of a breach that could harm the data or the people it belongs to. Tell those people too, without undue delay and in plain language.
- 04
Check every transfer abroad
Article 29 and the Transfer Regulation decide when data can leave the Kingdom. Keep each transfer to the minimum data needed. An analytics or ad platform processing visitor data outside Saudi Arabia counts as one.
- 05
A data protection officer, in three cases
Required when a public entity processes personal data at large scale, when your core activities need regular and systematic monitoring of people, or when they rest on sensitive data (Implementing Regulation, Art. 32). An employee or an outside contractor can fill the role.
- 06
Processing records and impact assessments
Keep a record of processing that SDAIA can ask for: purposes, who the data is about, who receives it, transfers abroad and retention periods (Art. 31). Write an impact assessment when you process sensitive data, link datasets from different sources, or monitor people constantly (Implementing Regulation, Art. 25).
Proof of consent
Consent records: what you must be able to show
Relying on consent means being able to show it was given. For each visitor, a website should be able to say when they chose, what they were shown, which categories they accepted or refused, and whether they later changed or withdrew that choice.
The Implementing Regulation is specific here. Consent has to be documented in a way that allows later verification, "such as keeping registers recording Data Subjects' consent", with the time and the means (Art. 11). And once SDAIA formally notifies an organisation of an alleged violation, it has five days to respond. You can't rebuild a consent history in five days. A banner that shows a message and stores nothing leaves a website with nothing to show.
- When
- The date and time of each choice, so a record can be matched to what the site was doing at that moment.
- What the visitor was shown
- The purposes and categories presented, in the language the visitor saw them in.
- What they chose
- Each category accepted or refused, not a single yes or no.
- What changed later
- Every later change or withdrawal, kept alongside the original choice rather than overwriting it.
Arqam360 stores every choice with its date and time and the categories the visitor accepted or refused. You can review the records in the dashboard and export them as a CSV file.
What an SDAIA investigation would ask you to proveGoogle Consent Mode v2
Does Google Consent Mode v2 apply to Saudi websites?
Not as Google's own rule. Google requires consent for visitors in the European Economic Area, the UK and Switzerland, and Consent Mode v2 is how it expects that consent to arrive. For Saudi visitors, the obligation comes from PDPL: a store needs consent before non-essential tracking runs, and Consent Mode v2 is how Google tags learn the visitor's choice.
How Arqam360 handles it
Arqam360's banner sets all four signals to denied by default, then updates them when the visitor chooses: analytics consent grants analytics_storage, and marketing consent grants ad_storage, ad_user_data and ad_personalization. For tags that do not read Consent Mode, such as the Meta Pixel and TikTok, Arqam360 has a script-blocking setting that holds known tracker scripts until consent. It is off by default, because blocking scripts can break a storefront, so switch it on and then check your store.
The full Google Consent Mode v2 guide, with setup and testingSalla, Zid, Shopify and WordPress
What do Salla, Zid, Shopify and WordPress sites need to do for PDPL cookie consent?
The same thing on all four: show a banner that asks before analytics and advertising tags run, record each visitor's choice, keep the settings reachable so consent can be withdrawn at any time, and pass the choice to Google tags through Consent Mode v2. What differs between the platforms is how the banner reaches your site.
Salla stores
The Arqam360 Salla app is in Salla's review and not yet listed in the Salla App Store. Once it is installed, your account is created during the install, with Arabic as the banner's default language; the banner reaches your storefront through Salla's app snippets, so there is no code to paste into your theme, and the Arqam360 dashboard opens inside your Salla admin.
Zid stores
Install the Arqam360 Zid app and it connects through Zid's own sign-in, creates your account with Arabic as the default language, and adds the banner to your storefront through Zid's app snippet, with no theme edit. The dashboard opens inside your Zid admin, and billing runs through Zid.
Shopify stores
The Arqam360 Shopify app delivers the banner through a theme app embed, and Shopify leaves app embeds off until you turn them on. After installing, open Online Store → Themes → Customize → App embeds and switch Arqam360 on. Until you do, the banner does not load, and if Shopify's own cookie banner is enabled, that is the one your visitors see. Billing runs through Shopify.
WordPress and WooCommerce sites
Install the Arqam360 plugin from the WordPress.org plugin directory and connect it to your Arqam360 account. The plugin adds the banner to your site, and the Arqam360 dashboard opens inside your WordPress admin.
On any platform, check the storefront rather than the settings: open your store in a private window, confirm the banner appears before you make a choice, and run the free scanner to see which cookies your store sets.
Scan your storeThe Saudi stack
Which local scripts does a Saudi store add?
Beyond Google and Meta tags, Saudi stores often load scripts from local payment and buy-now-pay-later providers. Whether a banner has to hold one back depends on what it is for: a cookie a payment needs to work is a different case from one used for marketing.
Our tracker pages list the cookie names our scanner matches for each provider and the consent category it assigns: Tabby and Tamara under marketing, Mada under necessary. Use them to check your own cookie declaration against what your storefront actually sets.
What Saudi stores actually do
How many Saudi stores ask before they track?
Most do not, on the evidence available. In the September 2026 edition of the KSA E-Commerce Privacy Compliance Index, 1,065 of 1,556 Saudi storefronts scanned (68%) loaded tracking before the visitor gave consent, and 935 of 1,556 (60%) ran trackers or non-essential cookies with no consent banner at all.
The Index is our own dataset: real-browser scans of each store's homepage, archived on Zenodo with the CSV and the report (DOI 10.5281/zenodo.23053713). It covers the storefront only, not checkout or back-end processing. An independent academic study points the same way: Albesher, Alsaad and Alhussain evaluated cookie consent interfaces on 144 high-traffic websites accessed in Saudi Arabia, across government, commerce, finance, healthcare and education, and found widespread non-compliance with privacy and design guidelines. Only 10.42% of those sites let visitors revisit their preferences (PeerJ Computer Science, 2026).
Beyond the banner
What else does PDPL ask of a website?
The banner is the part of PDPL a visitor sees. Behind it, the law also decides who it covers, how sensitive data is treated, when a data protection officer is needed, how data may leave the Kingdom, what you owe your vendors' processing, and how fast you answer a customer's request.
Who PDPL covers
PDPL applies to any organisation that processes personal data of people in Saudi Arabia, including organisations based outside the Kingdom. A European brand shipping to Riyadh or a Dubai agency running Saudi campaigns is inside it. Processing by an individual for purely personal or family purposes is outside it.
PDPL for companies based outside Saudi ArabiaSensitive data
PDPL treats some categories as sensitive: racial or ethnic origin; religious, intellectual or political belief; security and criminal data; biometric and genetic data used to identify a person; health data; and data showing that one or both of a person's parents are unknown. Processing them carries stricter conditions, and disclosing sensitive data with intent to harm or for personal gain is the one route to the criminal penalty. Credit data is not on the list in the amended text, but it has its own rule: processing it needs explicit consent.
Data protection officer
The Implementing Regulations require a data protection officer in three cases: a public entity whose services involve processing personal data at large scale; an organisation whose core activities involve regular, continuous monitoring of individuals at large scale; and one whose core activities involve processing sensitive data. Most small and mid-sized businesses fall outside all three, but still need someone who owns data protection.
Sending data outside the Kingdom
Personal data can leave Saudi Arabia under the Regulation on Personal Data Transfer outside the Kingdom: to a country with an adequate level of protection, or with appropriate safeguards such as standard contractual clauses or binding corporate rules, within the exceptions the regulation sets. For a website, this covers more than hosting. Analytics and advertising platforms that process visitor data abroad are transfers too.
Your vendors' processing
You stay responsible for personal data your vendors process for you: the platform, payment and shipping providers, email and analytics tools. PDPL expects you to choose processors that give sufficient guarantees and to check they keep to them, which in practice means a written data processing agreement with each and an up-to-date list of who receives what.
Customer requests
People can ask to be told how their data is used, get a copy of it, have it corrected or destroyed when it is no longer needed, and withdraw consent. Requests have to be answered within 30 days, so a website needs a documented way to receive them, verify who is asking, and search every system that holds the data.
How to handle data subject requests without a backlogPrimary sources
Where to download the PDPL text (PDF)
SDAIA publishes the law and its regulations as PDF files, in Arabic and English, on its laws and regulations page. Read the amended text. The law was changed by Royal Decree M/148 in March 2023, before it came into force, and some guides still quote the 2021 version.
The difference shows up in the penalties. Guides written from the 2021 text list a prison term of up to one year for transferring data abroad unlawfully. The amended text SDAIA publishes has no such penalty: the only prison term left is for disclosing sensitive data with intent to harm or for personal gain (Article 35).
- Personal Data Protection Law, amended text (English, PDF)
Royal Decree M/19 as amended by Royal Decree M/148. 43 articles: scope, rights, consent, transfers, penalties.
- Implementing Regulation (English, PDF)
Where the detail lives: how consent is recorded, the 30-day reply, the 72-hour breach notice, impact assessments, the data protection officer.
- SDAIA's laws and regulations page
The Arabic texts, the Regulation on Personal Data Transfer outside the Kingdom, and SDAIA's guidelines.
Templates and tools
Put it into practice
- Cookie policy template for PDPL
Arabic and English, with placeholders for your own cookies.
- Cookie banner text in Arabic and English
Ready-to-copy wording for the banner, the preferences panel and the accept and reject buttons.
- Privacy policy generator
A bilingual privacy policy for your store from a short wizard.
- Free cookie scanner
See which cookies and trackers your store sets before and after consent.
- Arabic cookie banner guide
Right-to-left layout, wording and testing for an Arabic banner.
- PDPL readiness quiz
Ten questions, a score and what to fix first. Not SDAIA's official self-assessment.
Penalties for Non-Compliance
Since 14 September 2024 the full penalty framework applies, and it is being used: SDAIA confirmed 48 enforcement decisions in its 16 January 2026 announcement, according to summaries by Clyde & Co and Profectus. The categories it named include processing without a valid legal basis and marketing sent without consent.
- 01
Administrative Fines
Fines of up to SAR 5,000,000 (about $1.33M at the fixed rate of 3.75 riyals to the dollar). For a repeat violation, the ceiling doubles to SAR 10,000,000.
- 02
Criminal Penalty
Up to two years' imprisonment and a fine of up to SAR 3,000,000 for disclosing sensitive personal data with intent to harm or for personal gain. A website running an analytics or advertising tag without consent faces the administrative track, not this one.
- 03
Five Days to Respond
Once formally notified of an alleged violation, an organisation has five days to respond. That is too short to build consent records or a processing inventory from scratch, so they need to exist beforehand.
- 04
What Gets Penalised
The violation categories named in SDAIA's January 2026 announcement include processing personal data without a valid legal basis, unauthorised disclosure, inadequate safeguards, and marketing sent without consent.
What Arqam360 does for PDPL compliance
- 01
A consent banner that asks by purpose
The banner asks for consent by category, in Arabic with a right-to-left layout or in English, and holds analytics and advertising tags to the visitor's choice through Google Consent Mode v2.
- 02
Customer requests in one queue
Requests come in through a web form with email verification and are tracked in the dashboard. For a connected Shopify, Salla or Zid store, Arqam360 can pull the requester's data from the store automatically.
- 03
Consent records you can export
Each choice, including a later change, is stored with its date, time and the categories accepted or refused. Review them in the dashboard or export them as a CSV file when someone asks for proof.
- 04
A scan of what your website actually sets
The free scanner loads your storefront in a real browser and lists the cookies and trackers it sets before any choice is made, matched against 124 known cookie patterns.
Enforcement Timeline
PDPL issued
Royal Decree M/19 of 9/2/1443H (16 September 2021) issued the Personal Data Protection Law, to come into force 720 days after its publication in the Official Gazette.
Law amended before it applied
Royal Decree M/148 of 5/9/1444H (27 March 2023) amended the law. The amended text is the one SDAIA publishes, and it is the version that allows processing for a controller's legitimate interest, never for sensitive data.
Implementing Regulations
SDAIA issued the final Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom on 7 September 2023, after drafts published for consultation in 2022. The Transfer Regulation has since been amended (version 2.0, August 2024).
Law Comes Into Force
The PDPL came into force on 14 September 2023, with a one-year grace period for organisations to bring existing processing into line.
Grace Period Ends
The one-year grace period for existing processing ended on 14 September 2024, and the full penalty framework applies from that date.
48 Enforcement Decisions
SDAIA's 16 January 2026 announcement confirmed 48 enforcement decisions under PDPL.
Draft amendments open for comment
On 6 October 2026 SDAIA opened a public consultation on draft amendments to the Implementing Regulation, on the Istitlaa platform. The draft is not in force; the current Implementing Regulation still applies. Clyde & Co's summary says the draft would require controllers to keep evidence of consent.
Check what your website does before consent
Run the free scanner on your storefront to see which cookies and trackers load before a visitor chooses. That is the part of PDPL compliance anyone can check from outside.
Check Your PDPL ComplianceDone for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
Saudi PDPL FAQ
Common questions about the Saudi Personal Data Protection Law.
PDPL was enacted in September 2021, came into force on 14 September 2023, and has been enforced since 14 September 2024, when the one-year grace period ended. SDAIA issued the final Implementing Regulations and the Transfer Regulation in September 2023; the 2022 versions were drafts for consultation.
Questions, answered
Put a PDPL consent banner on your website
Setting up the banner takes minutes. PDPL compliance is broader than that, covering records, data subject requests and transfers, but the banner is the part your visitors see first. We can install it and test your Google and Meta tags for you.