Compare requirements across 12 critical areas
EU residents globally - comprehensive extraterritorial reach
Saudi Arabia residents and businesses - limited extraterritorial application
6 lawful bases including consent, legitimate interests, legal obligation, etc.
Consent and legitimate interests - similar but less comprehensive
8 comprehensive rights including data portability and automated decisions
7 data subject rights - similar to GDPR but less detailed
Independent DPA in each EU member state
Saudi Data & AI Authority (SDAIA) - centralized authority
No mandatory registration (except DPO notification)
Mandatory registration with SDAIA required
72 hours to authority, without undue delay to individuals
72 hours to SDAIA - similar timeline
Up to €20M or 4% of global annual revenue
Up to SAR 5M (~$1.3M) or 2% of annual revenue
Mandatory for public authorities and large-scale processing
Required for certain categories of controllers
Adequacy decisions, SCCs, BCRs, or other safeguards required
SDAIA approval required for transfers outside Saudi Arabia
16 years (member states can lower to 13)
18 years - parental consent required for minors
No data localization - free flow within EEA
Data may be required to be stored in Saudi Arabia for certain categories
Enforced since May 25, 2018 - mature framework
Effective March 2023 - newer with evolving guidance
Unique aspects of Saudi Arabia's law
Unlike GDPR, PDPL requires mandatory registration of data controllers with the Saudi Data & AI Authority. This is a critical first step for compliance.
PDPL may require certain categories of data to be stored within Saudi Arabia. Cross-border transfers require SDAIA approval, unlike GDPR's adequacy framework.
PDPL is heavily inspired by GDPR. Organizations compliant with GDPR will find many familiar requirements, though key differences exist in registration and localization.
In ReadyGDPR, GDPR is adoptable with its own control catalogue (36 controls). PDPL is covered as a reference guide only and cannot be adopted in the product.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.