Privacy policy under the Personal Data Protection Law (PDPL, Royal Decree No. M/19 of 2021), in full force since 14 September 2024 and enforced by SDAIA, which issued 48 violation decisions in 2025–2026 with fines of up to SAR 5 million.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY (سياسة الخصوصية)
Legal entity name (Commercial Registration No. Commercial Registration (CR) number)
This policy is issued under the Personal Data Protection Law (Royal Decree No. M/19 of 2021), in full force since 14 September 2024, regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA). SDAIA has been an active enforcer — 48 violation decisions were issued in 2025–2026 — with fines of up to SAR 5 million (doubled for repeat violations; intentional leakage of sensitive data can carry up to 2 years' imprisonment).
1. DATA WE COLLECT 1.1. Categories of data collected
2. WHY WE COLLECT IT 2.1. Purposes of processing 2.2. Legal basis: Legal basis. Consent is the default legal basis under the PDPL; for marketing communications, only an explicit opt-in is acceptable, and legitimate interest is NOT an available basis for processing sensitive personal data.
3. RETENTION 3.1. Retention period
4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors
5. CROSS-BORDER TRANSFER 5.1. Cross-border transfer 5.2. Transfers outside the Kingdom must comply with SDAIA's Data Transfer Regulations.
6. DATA PROTECTION CONTACT 6.1. Data protection contact 6.2. Registration on the National Data Governance Platform and appointment of a dedicated Data Protection Officer are required only where SDAIA's criteria for large-scale or sensitive processing are met — a smaller business needs only a documented contact person.
7. YOUR RIGHTS 7.1. Data subject rights and request channel
Version date: Policy version date
— — — ⚠️ This is a boilerplate template, not legal advice. It is written under the Saudi Labor Law (Royal Decree No. M/51 of 2005, as amended by Royal Decree No. M/44 of 23 August 2024, in force from 19 February 2025) and related regulations and digital platforms (Qiwa, Najiz, GOSI, Mudad, PDPL/SDAIA, E-Commerce Law, SFDA, Shomoos, ZATCA/Fatoora, Balady) as in effect in July 2026 — these platforms and their implementing regulations change frequently; verify against the current text before use. Have this template reviewed by a Saudi-qualified lawyer and, for HR documents, checked against your own HRSD-approved work organization regulation (لائحة تنظيم العمل) before use.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
Legitimate interest is not an available basis for sensitive personal data under the PDPL
Destination countries and safeguards, per SDAIA's Data Transfer Regulations
A dedicated DPO is required only where SDAIA criteria for large-scale/sensitive processing are met
1 of 11 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.