← ALL REGULATIONS
Saudi PDPL and cookies: consent first, with defined exceptions.
Saudi Arabia’s Personal Data Protection Law has no cookie-specific rule, but personal data collected through cookies may not be processed without consent unless an exception applies, such as a legitimate interest that involves no sensitive data. SDAIA’s privacy policy guideline lists cookie data among what a privacy policy has to disclose.
Saudi PDPL at a glanceConsent, with exceptions
- Applies to
- Processing of personal data in Saudi Arabia, including processing from abroad of data about people living there
- In force
- 14 September 2023, fully enforceable since 14 September 2024 after a one-year grace period
- Enforced by
- Saudi Data and AI Authority (SDAIA)
- Penalties
- A warning or fines up to SAR 5 million, which can be doubled for a repeat; disclosing sensitive data to cause harm or for gain carries up to two years in prison, a SAR 3 million fine, or both
WHAT SAUDI PDPL REQUIRES
What the PDPL asks of a site that uses cookies.
THE RULEConsent, unless an exception appliesProcessing needs consent except in the cases the Law lists, which include a legitimate interest of the controller that does not harm the person’s rights and involves no sensitive data. Relying on legitimate interest needs a documented assessment first.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran. Auto uses GDPR mode for Saudi timezones.
THE RULESeparate, documented consent for each purposeConsent must be freely given, not obtained by misleading means, given after the purposes are explained, obtained separately for each purpose, and documented so it can be verified later.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected. Each decision is stored with its categories, its time and a truncated IP address, and can be queried and exported through the API, CLI or MCP server. Katla keeps the latest decision per visitor.
THE RULEWithdrawal as easy as consentPeople can withdraw consent at any time, and withdrawing must be as easy as giving consent, or easier.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
THE RULEA privacy policy that covers cookiesThe privacy policy must be available before collection. SDAIA’s guideline lists cookie data among the categories to disclose, and suggests linking a cookie policy and writing in a language suited to the audience.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages. Neither the banner nor the generated policy is available in Arabic.
THE RULETransfers outside the KingdomSending personal data to a party outside Saudi Arabia is governed by SDAIA’s Regulation on Personal Data Transfer outside the Kingdom, which covers safeguards and keeping transfers to the minimum data needed.
WITH KATLAKatla runs in AWS eu-central-1 (Frankfurt), so consent records, with their truncated IP addresses, are stored outside the Kingdom. Assessing that transfer is for you to do.
Saudi PDPL questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does the Saudi PDPL require a cookie banner?
- It does not mention cookies, but cookies that collect personal data need consent unless an exception applies, and a banner is how sites ask for it.
- When did the PDPL take effect?
- It came into force on 14 September 2023, with a one-year grace period for compliance that ended on 14 September 2024.
- What are the penalties?
- A warning or a fine of up to SAR 5 million, which can be doubled for a repeat violation. Disclosing or publishing sensitive data to harm the person or for personal benefit is punishable by up to two years in prison, a fine of up to SAR 3 million, or both, and people who suffer damage can claim compensation in court.
- Do I need a data protection officer?
- Only in the cases the Implementing Regulation sets out, such as when a controller’s core activities involve sensitive data, or regular and systematic monitoring of people. Appointing one is outside what a consent tool does.
- How does Katla treat visitors in Saudi Arabia?
- Auto mode reads the visitor’s timezone and uses the opt-in GDPR banner outside the Americas, so visitors in Saudi Arabia are asked before any non-essential cookie is set. The banner is not available in Arabic.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.