PDPL (Personal Data Protection Law)
Also known as: PDPL · Saudi data protection law · نظام حماية البيانات الشخصية
The Personal Data Protection Law (PDPL) is the Saudi law that governs collecting, processing, sharing and transferring personal data outside the Kingdom, and gives individuals rights such as being informed, access, correction and destruction. It came into force on 14 September 2023 with a one-year compliance period and is overseen by the Saudi Data and AI Authority (SDAIA).
What it means for HR
Employee and candidate data is personal data, and some of it, such as health information, is sensitive. In practice:
- Tell employees what you collect and why, in a privacy notice.
- Limit access to need: not every user should see pay or medical reports.
- Keep data only as long as needed, then destroy or anonymise it.
- Take care with transfers outside the Kingdom, which have conditions and controls.
- Log access to sensitive data.
In RafiqHR
Field-level permissions, an audit log of sensitive reads, encryption in transit and at rest, and masking of personal data before AI. Details are in the privacy policy.
Official sources
This is general information to help you understand the topic. It is not legal advice. Rules and rates change: always check the official text on the relevant authority’s platform and consult a qualified adviser before acting.
