PDPL compliance for fintechs

The PDPL framework at a glance

Dates for the amending decree, the regulations and the DPO rules come from law-firm reporting. Most sources give a one-year grace period; one source claims a longer one.

SDAIA runs the regime through the national data governance platform

SDAIA supervises the PDPL. Its National Data Governance Platform at dgp.sdaia.gov.sa opens onto a personal data protection portal. Published guidance describes it as the place for controller registration, the National Register of Controllers, DPO details and breach notification. Law-firm reporting adds that the Saudi Business Center is used to authorise the representative who registers the entity.

Enforcement is under way. The Committees for Reviewing PDPL Violations are issuing decisions, according to published commentary, so a fintech should treat its PDPL file as something an examiner or complainant can test today.

Why fintechs carry more PDPL risk than most

Payment, lending, wallet and investment businesses process identity documents, account data, transaction histories and device data in volume. Much of it lives in cloud services, and much of it is shared with banks, identity-verification vendors and group companies outside the Kingdom.

Each of those flows needs a lawful basis and a record. Where data leaves Saudi Arabia, it needs a route under the Transfer Regulation and a documented transfer assessment. Most gaps we find sit in the flows nobody thought of as a transfer: offshore support desks, analytics tools and group reporting.

Draft amendments open for comment until 5 November 2026

Proposals only. Draft amendments to the Implementing Regulations were published on Istitlaa, the public consultation platform, for comment from 6 October to 5 November 2026, as reported by Clyde & Co. They are not in force and may change.

Practical PDPL compliance steps

1. Map your data

   A record of processing that covers customers, merchants, staff and counterparties: what you collect, why, where it is stored, who receives it and how long you keep it.

2. Register and appoint

   Check whether you must register as a controller on the National Data Governance Platform today, plan for the draft that would make registration mandatory, and appoint a DPO under SDAIA's rules.

3. Assess transfers

   For every flow out of the Kingdom, identify the basis under the Transfer Regulation and document a transfer impact assessment. Cloud regions, offshore KYC vendors and group reporting are the usual gaps.

4. Write notices and consents

   Privacy notices in Arabic and English, consent records for marketing, and a working process for data subject requests.

5. Prepare for breaches

   A playbook that gets you to a notification decision inside 72 hours, tied to your incident response and to the reporting you owe your financial regulator.

6. Contract and test

   Processor terms with every vendor, then periodic testing of the controls. See ongoing compliance.

How the PDPL fits with SAMA, NCA and CST rules

The PDPL is one layer. A SAMA or CMA licensee also answers to its regulator's own cyber security and outsourcing requirements, and the regulator will read your data protection set-up through that lens. Those regulator rules are separate from the PDPL and are not summarised here.

Two other bodies affect the same decisions. The National Cybersecurity Authority's Cloud Cybersecurity Controls (CCC-2:2024) apply to cloud providers and tenants and were updated for data-localisation changes. The Communications, Space & Technology Commission registers cloud providers in tiers. A fintech choosing a cloud provider should check CST registration, the provider's class and data location against the PDPL transfer rules and its regulator's outsourcing rules at the same time.

In practice we build one data and cloud map that answers the PDPL transfer questions, the outsourcing questions your regulator will ask and the cloud control questions together. The security side is covered in cybersecurity compliance.

Common questions