Saudi PDPL and Marketing Websites: A Practical Planning Checklist
- Inventory every form, chat button and tracking tag before deciding what consent and notices you need.
- Direct marketing needs separate, documented consent and an opt-out at least as easy as opting in (Implementing Regulation, Article 29).
- Processor contracts, cross-border safeguards and a written processing record are required, not optional extras.
- Breaches that could cause harm must be reported to the Competent Authority within 72 hours; name an owner now.
A lead-generation site can collect personal data within seconds: a name and mobile number in a quote form, and analytics cookies or ad pixels that can carry identifiers. Under the Personal Data Protection Law (PDPL), collecting and using that data is processing of personal data where it relates to an identifiable person, and the site owner is usually the controller responsible for it. This checklist turns the relevant rules into tasks your marketing, web and legal teams can divide up.
This is not legal advice. It is a planning aid from a web and marketing agency. Before you finalise consent wording, privacy notices, vendor contracts or transfer arrangements, have them reviewed by a qualified legal adviser who follows the current Saudi rules.
Where the rules come from
The framework has three layers: the PDPL, the Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom (published together in one SDAIA document), and guidance issued by the Saudi Data and AI Authority. SDAIA's guide for controllers and processors states that the law came into force on 14 September 2023 with a one-year grace period, and that organisations were expected to reach compliance by 14 September 2024. The same guide names SDAIA as the Competent Authority under a Council of Ministers decision, so check SDAIA's current publications for any change in supervisory arrangements.
SDAIA's data protection page explains that compliance is evaluated periodically through the National Data Governance Platform now that the grace period has ended, and that the platform lets individuals file complaints. The platform also hosts the personal data breach notification service.
The planning checklist
1. Inventory every form and tag
List each point where the site collects or sends personal data: forms, booking and chat widgets, WhatsApp links, call tracking, analytics, ad pixels and session recorders. The PDPL defines personal data broadly as data that may identify a person directly or indirectly, so include identifiers that are not names. For each item, record the fields captured, the purpose, where the data goes and which vendor receives it.
2. Minimise form fields
The Implementing Regulation requires controllers to collect only the minimum personal data needed for the purpose. If a callback form only needs a name and mobile number, remove fields you never use. Where fields are optional, say so: controllers must tell people whether providing data is mandatory or optional.
3. Separate consent for marketing messages
Article 29 of the Implementing Regulation says that before processing personal data for direct marketing you must obtain consent under Article 11, give an opt-out that is at least as easy as opting in, clearly identify the sender, and stop immediately when consent is withdrawn. Article 11 requires consent to be freely given, specific, documented with the time and method, and obtained separately for each purpose. Article 25 of the PDPL applies a similar rule to advertising sent through personal channels such as email and post, and Article 28 of the regulation adds that stopping such messages must be free of charge.
In practice: do not pre-tick a marketing box, and do not bundle "contact me about my enquiry" with "send me offers". Log who consented, when, on which form version and to what.
4. WhatsApp, SMS and email campaigns
Apply the same standard to every channel: each WhatsApp broadcast, SMS and email names your business and offers a working way to stop. Sync opt-outs across tools so someone who unsubscribes by email is not still in a WhatsApp audience. These articles apply without prejudice to the Telecommunication and Information Technology Act and related rules, so confirm channel-specific requirements with your adviser.
5. Privacy notice in Arabic
Article 12 of the PDPL requires a privacy policy available before collection, covering the purpose, the data collected, how it is collected, processed, stored and destroyed, and the data subject's rights. Article 4 of the regulation adds the controller's identity and contact channel, the legal basis, the retention period or the criteria for it, how to withdraw consent, and whether each field is mandatory. Article 13 of the law also requires disclosure of who receives the data and whether it is processed outside the Kingdom. We recommend publishing it in Arabic (a practical choice, not a stated legal requirement in the articles cited) and linking it beside every form.
6. Cookies, pixels and tag management
The PDPL texts we reviewed have no cookie-specific article, but tracking identifiers can still be personal data, and pixels often send data to vendors abroad. Decide with your legal adviser which tags need consent before they fire. Configure your tag manager accordingly and test it in a clean browser.
7. CRM and vendor contracts
Your CRM, email platform, WhatsApp provider, form builder and hosting company often act as processors, although a vendor's role depends on the arrangement and some may be independent or joint controllers for their own processing. Article 17 of the regulation requires your agreement with each processor to cover the purpose, data categories and duration of processing, breach notification to you without undue delay, whether the processor is subject to foreign laws, and any subcontractors. You must also assess processors periodically.
8. Storage location and cross-border transfers
Many marketing SaaS tools store data outside the Kingdom. The Transfer Regulation requires limiting transferred data to the minimum necessary and ensuring the transfer does not weaken individuals' rights or your ability to meet breach and destruction duties. Where no adequacy decision applies, it lists safeguards such as SDAIA's Standard Contractual Clauses, and Article 8 requires a transfer risk assessment in specified cases.
9. Retention and deletion
Article 18 of the PDPL requires destroying personal data without undue delay once it is no longer needed, subject to legal retention duties. Set retention periods for unconverted leads, form emails, exported spreadsheets and ad audience lists. Article 8 of the regulation also expects destruction to reach copies held by others and backups.
10. Access and other rights requests
People can ask to be informed, access their data, obtain a copy, correct it or request destruction. Article 3 of the regulation sets a response period of up to 30 days, extendable by up to 30 more with advance notice, and requires identity checks and a log of requests. Publish one request channel and name who handles it.
11. Security basics
Article 23 of the regulation points to National Cybersecurity Authority controls or recognised standards. For a marketing site: HTTPS, few admin accounts with multi-factor sign-in, patched plugins and restricted CRM exports.
12. Breach response owner
Article 24 requires notifying the Competent Authority within 72 hours of becoming aware of a breach that could harm the data or individuals, and notifying affected people without undue delay where it may harm them. Name an owner and rehearse the process once.
13. Records to keep
Article 33 of the regulation requires a written record of processing activities, retained for the processing period plus five years, covering purposes, data categories, recipients, retention, transfers outside the Kingdom and security measures. SDAIA publishes a records of processing activities guideline. Keep consent logs, processor agreements, transfer assessments and breach reports alongside it.
Who owns what
| Checklist item | Typical lead | Evidence to keep |
|---|---|---|
| Form and tag inventory | Web and marketing | Data map per form and tag |
| Marketing consent and opt-out | Marketing, legal review | Consent log, form versions |
| Arabic privacy notice | Legal, web publishes | Dated notice versions |
| Tag consent setup | Web and analytics | Tag manager configuration, test notes |
| Vendors and transfers | Procurement, legal | Processor agreements, transfer assessments |
| Rights requests and breaches | Named owner or DPO | Request log, breach reports |
How Eclipse fits in
Eclipse offers website development and can help implement technical items such as consent-aware tag management, separated consent checkboxes with logging, Arabic privacy notice pages, CRM integrations and form minimisation. See our website development service. The legal decisions, including your lawful basis, notice wording and transfer arrangements, should come from your legal adviser. If you want the technical side reviewed, contact our team.
Frequently asked questions
Does the PDPL apply to a simple contact form?
Yes, in most cases. A name and mobile number can identify a person, and collecting or storing them is processing under the PDPL. The website owner is usually the controller responsible for it.
Can one checkbox cover both my enquiry and marketing messages?
It is safer not to combine them. Article 11 of the Implementing Regulation requires separate consent for each processing purpose, and Article 29 requires consent before direct marketing. Use a separate, unticked marketing option and log it.
How fast must we report a data breach?
The Implementing Regulation requires notifying the Competent Authority within 72 hours of becoming aware of a breach that could harm the data or the people concerned. Affected individuals must be notified without undue delay where the breach may harm them.
Sources: sdaia.gov.sa · sdaia.gov.sa · dgp.sdaia.gov.sa · sdaia.gov.sa · dgp.sdaia.gov.sa · sdaia.gov.sa · sdaia.gov.sa