Selling Into Saudi Arabia From Oman: What the Saudi PDPL Requires From a Company Outside the Kingdom
If your company in Oman processes personal data of people residing in Saudi Arabia, the Saudi Personal Data Protection Law (PDPL) applies to you, whether or not you have an office in the Kingdom. That covers an online store shipping to Riyadh, a software product with Saudi users, and a service business holding Saudi customers’ records.
Two things changed in October 2026. SDAIA, the regulator, opened its controller registration to organisations outside the Kingdom. And it published draft amendments that would make storing personal data inside Saudi Arabia the default. That draft is open for public comment until 5 November 2026 and is not yet in force.
This article is about what the Saudi law asks of a company that serves Saudi customers from Oman or elsewhere in the GCC. For how it compares with the other Gulf laws, see data protection laws across the GCC, side by side.
The short answer
- Scope: the PDPL covers processing of personal data of individuals residing in Saudi Arabia, including by parties outside the Kingdom.
- Registration: since October 2026, foreign controllers can register on SDAIA’s National Data Governance Platform. Registration is mandatory where your main activity is processing personal data or where you process sensitive data.
- Breach notification: 72 hours to SDAIA where a breach is likely to cause harm, notified through the platform.
- Penalties: up to SAR 5 million per violation, doubled for repeat offences, and imprisonment for unlawful disclosure of sensitive data.
- Pending: a draft amendment would make in-Kingdom storage the default and widen registration to anyone transferring data abroad.
Does the Saudi law apply to you?
The PDPL was issued by Royal Decree M/19 in 2021 and amended in 2023. It came into force on 14 September 2023, and controllers had until 14 September 2024 to comply. As summarised by DLA Piper, it covers processing in the Kingdom by any means. It also covers processing of personal data of individuals residing in the Kingdom by entities outside it.
Three tests make that concrete for an Omani business:
- Do you hold personal data of people living in Saudi Arabia? Customer accounts, delivery addresses, support tickets, newsletter subscribers and B2B contacts at Saudi companies all count, because a named contact person is a natural person.
- Do you process it in any way? Storing it counts. So does sending an invoice or keeping it in a CRM.
- Is it outside the narrow exceptions? Purely personal or family use is excluded. Commercial activity is not.
If you answered yes three times, plan as though the PDPL applies. The harder question is how SDAIA would enforce it against a company with no Saudi presence. Before October 2026 that question had a practical answer — foreign companies could not even register. That answer has now gone.
What the law asks of you from outside the Kingdom
The obligations are the same ones a Saudi company carries. What differs is how you meet them at a distance.
A lawful basis for each purpose. Consent is the main basis. The 2023 amendments added processing for the controller’s legitimate interests, as long as it does not prejudice the data subject’s rights and the data is not sensitive. That is broader than Oman’s law, which has no legitimate-interest route. A system serving both countries should record the basis per purpose and per country, not once globally.
A privacy policy people can read before you collect. SDAIA’s draft amendments would require clear, simplified language suited to the audience. Commentators read that as requiring Arabic for most Saudi-facing services. If your Saudi customers see an English-only policy today, fix that before it becomes a rule.
Data subject rights, answered within 30 days. The current rules give controllers 30 days to respond. Under the draft, silence by the deadline would count as a rejection and open the way to a complaint to SDAIA. As with every regime, the work is in knowing where each person’s data lives.
A data protection officer in defined cases. SDAIA’s rules require a DPO where the controller is a public entity providing large-scale services, where core activities involve regular and systematic large-scale monitoring, or where core activities involve sensitive data.
Security and records. Controllers must take organisational, administrative and technical measures to protect data, including during transfers. They must also be able to show what they process and why.
Breach notification. Where required, you notify SDAIA within 72 hours of becoming aware, through the National Data Governance Platform. Affected individuals are told without undue delay where the breach could harm them.
Registration: what changed in October 2026
Until October 2026, the National Data Governance Platform required a Saudi commercial registration number. A foreign controller could not register, could not file a DPO appointment through it, and had no account to notify a breach through.
SDAIA has now added a registration service for external entities. As described by Clyde & Co and by a law-firm privacy blog in mid-October 2026, a foreign organisation authenticates through a Ministry of Foreign Affairs process and then registers on the platform. It must appoint an authorised representative for the process and receives a registration certificate. The service is new, and practical experience with it is still limited.
Is registration mandatory for you? Under SDAIA’s registration rules, it is required where the controller’s main activity is based on processing personal data or where it processes sensitive data. A software company whose product is a customer database, a clinic booking platform holding health data, and a marketing service built on personal data are all strong candidates. A manufacturer with a handful of Saudi buyers’ contact details probably is not, under the current rules.
One practical reason to register even when you are unsure: breach notifications go through the platform. Without an account you may be unable to meet a 72-hour deadline that already applies to you.
Transfers: when your own system is the transfer
The PDPL controls transfers and disclosures of personal data outside the Kingdom. Under the current Transfer Regulations, a transfer goes to a country with an adequate level of protection, or under appropriate safeguards, with limited exceptions. Any transfer must not affect national security or the Kingdom’s vital interests, and must be limited to what is necessary.
For a company in Oman, this raises a question the texts we reviewed do not settle. If a customer in Jeddah types their details directly into your website hosted in Muscat, has anyone “transferred” data out of the Kingdom? There is a stronger case where data clearly starts inside Saudi Arabia. Examples are a Saudi distributor sending you its customer list, a Saudi subsidiary syncing to your group ERP, or a Saudi data centre replicating to Oman.
Treat the first case as a question for a Saudi adviser, and the second as a transfer you need a basis for.
The draft amendments, and why to plan for them now
SDAIA published a revised draft of amendments to the Implementing Regulation on 6 October 2026, for consultation until 5 November 2026. An earlier round in 2025 was not finalised, so the draft may change again. As summarised by Clyde & Co and Reed Smith, the main proposals are:
- In-Kingdom storage by default. A new provision would have controllers keep personal data in the Kingdom while still permitting lawful transfers abroad. Reed Smith notes it could be read as requiring a local copy, and has asked SDAIA to clarify.
- Registration for anyone transferring data abroad. Transfer or disclosure outside Saudi Arabia would become a trigger in its own right.
- Breach notification without a harm test. Notification to SDAIA within 72 hours would apply whether or not harm is likely.
- Wider DPO and impact-assessment duties. Data protection impact assessments would be required for processing involving minors, large-scale monitoring, emerging technologies, or automated decisions affecting people’s rights.
- Faster responses to SDAIA: 20 business days for regulator requests.
- Plain-language privacy policies suited to the audience.
None of this is law yet. But the in-Kingdom storage proposal is the one that would change architecture, and architecture is slow to change. If your design keeps Saudi customers’ data in Oman with no path to a Saudi region, ask now what moving it would cost. Asking after adoption leaves you less time.
Penalties
The PDPL’s penalties, as summarised by DLA Piper:
| Violation | Penalty |
|---|---|
| Disclosing or publishing sensitive data in breach of the law, with intent to harm or for personal benefit | Up to 2 years in prison and/or a fine up to SAR 3 million |
| Other breaches | A warning or a fine up to SAR 5 million |
| Repeat offences | The fine may be doubled, up to twice the maximum |
Courts may also order confiscation of proceeds and publication of the decision at the violator’s expense. Anyone harmed can claim compensation.
What to do if you serve Saudi customers from Oman
- Tag Saudi data subjects in your systems. You cannot apply a country’s rules to records you cannot find.
- Record the lawful basis per purpose for Saudi customers — consent, contract or legitimate interest, never sensitive data on legitimate interest.
- Publish an Arabic privacy policy for Saudi-facing services, in plain language.
- Decide on registration. If your main activity is processing personal data, or you hold sensitive data, register through the external entities service.
- Add Saudi Arabia to your breach runbook with its 72-hour clock and the platform as the channel.
- Map data that starts in the Kingdom — distributors, subsidiaries, Saudi-hosted systems — and give each flow a transfer basis.
- Price an in-Kingdom option for Saudi data before the draft becomes final.
Frequently asked questions
Does the Saudi PDPL apply to a company with no office in Saudi Arabia? It covers processing of personal data of individuals residing in the Kingdom, including by entities outside it. A company in Oman holding Saudi customers’ data should plan on that basis. How enforcement would work against a company with no Saudi presence is less settled, but SDAIA’s October 2026 registration service for foreign entities points in one direction.
Do I have to register with SDAIA? Under SDAIA’s registration rules, registration is required where your main activity is processing personal data or where you process sensitive data. The October 2026 draft would add transfers outside the Kingdom as a trigger. If you are near either line, take advice — and remember that breach notification runs through the same platform.
Will I have to store Saudi customers’ data in Saudi Arabia? Not under the rules in force at the time of writing. A draft amendment under consultation until 5 November 2026 would make in-Kingdom storage the default while still permitting lawful transfers abroad. Watch for the final text before redesigning anything, but price the option now.
Can I rely on legitimate interest instead of consent? For non-sensitive data, the 2023 amendments allow processing for the controller’s legitimate interests, provided it does not prejudice the data subject’s rights. It is not available for sensitive data. Oman’s law has no equivalent, so a system serving both countries needs per-country lawful-basis records.
What is the maximum fine? Up to SAR 5 million per violation, which may be doubled for repeat offences. Unlawfully disclosing or publishing sensitive data with intent to harm or for personal benefit can bring up to two years’ imprisonment and a fine of up to SAR 3 million.
How fast must I report a breach to SDAIA? Within 72 hours of becoming aware, where the breach is likely to cause harm, through the National Data Governance Platform. The draft amendments would remove the harm condition for notification to SDAIA.
This article states the position under the Saudi PDPL and its regulations as in force, and the draft amendments as published for consultation, on 21 October 2026, the date of publication. It is not legal advice. The draft may change before adoption; confirm your position with a qualified adviser licensed in Saudi Arabia.
Sources: Clyde & Co — SDAIA opens controller registration for overseas organisations, October 2026 · Clyde & Co — SDAIA publishes draft amendments to the PDPL, October 2026 · Global Privacy Blog — SDAIA adds controller registration for foreign entities · Reed Smith — SDAIA consults on amendments to the Implementing Regulation · DLA Piper — Saudi Arabia data protection · Addleshaw Goddard — Saudi PDPL amendments, 2023
Selling into Saudi Arabia from Oman? ZAWAT builds business systems and web platforms that keep each country’s data, consent and hosting choices separable. Book a call.