Situations we help with
- Your company collects customer or employee data and has not reviewed its practices against the PDPL.
- You transfer personal data outside Saudi Arabia, for example to a cloud provider or a group company.
- You are buying or selling software, SaaS or IT services and need balanced terms.
- You run an online store or app and need compliant terms of use and a privacy notice.
- A data breach has happened and you need to know what to do next.
What the work covers
- PDPL gap assessments, privacy notices and internal data policies
- Records of processing, data processing agreements and cross-border transfer safeguards
- Data Protection Officer requirements and SDAIA registration questions
- Software licensing, SaaS, IT outsourcing and systems integration contracts
- E-commerce terms, consumer-facing terms of use and online platform rules
- Technology aspects of transactions and investments
What the PDPL requires in practice
For most companies, compliance comes down to a handful of practical steps:
- Know what data you hold. Map the personal data you collect, why, where it is stored and who receives it.
- Tell people. Publish a privacy notice that explains what you collect, the purpose and legal basis, and how individuals can exercise their rights.
- Have a lawful basis. Consent is one basis but not the only one; processing must be necessary and proportionate to its purpose.
- Contract with your processors. Vendors who handle data for you need written terms on security and confidentiality.
- Control transfers abroad. Put safeguards in place before data leaves the Kingdom.
- Prepare for incidents. Have a plan for detecting, assessing and reporting breaches.
Technology contracts
Software and SaaS contracts decide who carries the risk when systems fail, data is lost or a project overruns. The firm reviews service levels, liability caps, data clauses, intellectual property and exit arrangements so that what the business depends on is protected in writing.
How a consultation works
- 1
Tell us what you need
Send a short enquiry or call the office. Describe the matter in general terms — no confidential documents yet.
- 2
Conflict check and call-back
The firm checks that it can act for you, then contacts you to understand the matter.
- 3
Consultation
You meet a lawyer in Jeddah or online. You get an initial view of your position and options.
- 4
Scope and fees in writing
If you instruct the firm, you receive the scope of work and fees in writing before work begins.
Questions clients ask
When did the Saudi PDPL start being enforced?
Does the PDPL apply to foreign companies?
Can personal data be transferred outside Saudi Arabia?
Do we need a Data Protection Officer?
Official sources
Laws change. We cite the official text so you can check the current version.
This page is general information, not legal advice for your situation.