Saudi Arabia's PDPL and health data: a guide for AI teams
How Saudi Arabia's Personal Data Protection Law treats health data: explicit consent, transfer rules, SDAIA enforcement since September 2024 and penalties.
- Saudi Arabia
Key takeaways
- The PDPL took effect on 14 September 2023, with full enforcement from 14 September 2024.
- Health data is sensitive data and needs a stricter lawful basis, typically explicit consent; legitimate interest is not available for it.
- Transfers outside the Kingdom follow SDAIA's Transfer Regulation: adequacy, approved safeguards or a transfer risk assessment.
- Unlawfully disclosing sensitive data can bring up to two years' imprisonment and a fine of up to SAR 3 million.
What is Saudi Arabia’s PDPL?
The Personal Data Protection Law is Saudi Arabia’s main privacy law, overseen by the Saudi Data and AI Authority (SDAIA). It took effect on 14 September 2023 with a one-year grace period, and full enforcement began on 14 September 2024. It applies to processing of personal data of people in the Kingdom.
How does the PDPL treat health data?
Health data is classed as sensitive data. Processing it requires a stricter lawful basis, typically explicit consent, and legitimate interest cannot be used. Controllers must apply stronger security, limit access to people who need it, and keep records of processing.
What are the rules on sending data abroad?
SDAIA’s Regulation on Personal Data Transfer Outside the Kingdom allows transfers to countries with adequate protection, or under approved safeguards backed by a transfer risk assessment. The regulation was amended in 2024. For health AI, the simplest route is often to process in-Kingdom and send only de-identified data elsewhere.
What are the penalties?
| Breach | Maximum penalty |
|---|---|
| Unlawful disclosure or publication of sensitive data | Up to 2 years’ imprisonment and/or SAR 3 million |
| Other violations | Administrative fines, reported at up to SAR 5 million, doubled for repeat breaches |
Penalty figures above come from law-firm and adviser summaries; confirm against SDAIA’s official text.
What should a health AI team do?
Get explicit consent for health data, decide where data is stored and processed, run a transfer risk assessment for any cross-border flow, keep identifiers out of model prompts and logs, and document it all in a record of processing activities.
Frequently asked questions
Can we host a Saudi health app's data outside Saudi Arabia?
Only under SDAIA's transfer rules: to a country with an adequate level of protection, or with approved safeguards and a transfer risk assessment. Sector rules from health authorities may add further limits, so many teams keep health data in-Kingdom.
Does the PDPL apply to companies outside Saudi Arabia?
Yes, it applies to processing of personal data of individuals in the Kingdom, including by entities outside it. Foreign companies serving Saudi users should plan for PDPL compliance.
Sources
- Personal Data Protection LawSaudi Data and AI Authority (SDAIA)
- Data protection laws of the world: Saudi ArabiaDLA Piper
- KSA personal data protection law series, part 1PwC Middle East
- Data protection articleGrant Thornton Saudi Arabia
Found something out of date? Write to contact@brandlabs.app and we will fix it.