Privacy policy under the Personal Data Protection Law (PDPL, Royal Decree No. M/19 of 2021), in full force since 14 September 2024 and enforced by SDAIA, which issued 48 violation decisions in 2025–2026 with fines of up to SAR 5 million.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone.
Required fields not filled: 9. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
PRIVACY POLICY (سياسة الخصوصية)
(Commercial Registration No. )
This policy is issued under the Personal Data Protection Law (Royal Decree No. M/19 of 2021), in full force since 14 September 2024, regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA). SDAIA has been an active enforcer — 48 violation decisions were issued in 2025–2026 — with fines of up to SAR 5 million (doubled for repeat violations; intentional leakage of sensitive data can carry up to 2 years' imprisonment).
1. DATA WE COLLECT 1.1.
2. WHY WE COLLECT IT 2.1. 2.2. Legal basis: . Consent is the default legal basis under the PDPL; for marketing communications, only an explicit opt-in is acceptable, and legitimate interest is NOT an available basis for processing sensitive personal data.
3. RETENTION 3.1.
4. THIRD PARTIES AND PROCESSORS 4.1.
5. CROSS-BORDER TRANSFER 5.1. 5.2. Transfers outside the Kingdom must comply with SDAIA's Data Transfer Regulations.
6. DATA PROTECTION CONTACT 6.1. 6.2. Registration on the National Data Governance Platform and appointment of a dedicated Data Protection Officer are required only where SDAIA's criteria for large-scale or sensitive processing are met — a smaller business needs only a documented contact person.
7. YOUR RIGHTS 7.1.
Version date:
This is a boilerplate template, not legal advice. It is written under the Saudi Labor Law (Royal Decree No. M/51 of 2005, as amended by Royal Decree No. M/44 of 23 August 2024, in force from 19 February 2025) and related regulations and digital platforms (Qiwa, Najiz, GOSI, Mudad, PDPL/SDAIA, E-Commerce Law, SFDA, Shomoos, ZATCA/Fatoora, Balady) as in effect in July 2026 — these platforms and their implementing regulations change frequently; verify against the current text before use. Have this template reviewed by a Saudi-qualified lawyer and, for HR documents, checked against your own HRSD-approved work organization regulation (لائحة تنظيم العمل) before use.
Documents that are usually drawn up in the same process.
Guest registration record and Shomoos transmission checklist — the Ministry of Interior's Shomoos system requires every guest's details to be transmitted in real time at check-in, with fines per unre…
Return and refund policy required in writing before checkout under the E-Commerce Law (2019) — a 7-day return window for unused online purchases, mandatory shelf/menu prices inclusive of 15% VAT, and…
Compliance checklist for the ZATCA e-invoicing mandate — Phase 1 (generation) applies to all VAT-registered businesses since 4 December 2021; Phase 2 (integration) is rolling out in waves, with Wave…
1 of 11 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.