# PDPL (KSA) — what the Saudi Personal Data Protection Law means for messaging

> The Personal Data Protection Law (PDPL) is the Kingdom of Saudi Arabia's comprehensive data-protection framework, in force since 14 September 2023 with full enforcement from September 2024. It governs every collection, use, and cross-border transfer of personal data of individuals in KSA — including the MSISDN you message, the consent record you keep, and where in the world that data is processed.

- Canonical URL: https://www.broadnet.me/answers/pdpl-ksa-explained
- Language: en
- Last reviewed: 2026-05-27
- Publisher: BroadNet (https://www.broadnet.me)

## Who enforces it

SDAIA (Saudi Data and AI Authority) is the regulator. Penalties: up to SAR 5 million per violation, with criminal liability for officers of the controller in egregious cases. SDAIA's enforcement posture in the first 18 months has been corrective rather than punitive (warnings, mandatory remediation), but the law allows for class-action complaints and SDAIA has explicitly said large-scale messaging violations are a priority.

## Data residency

Personal data of KSA individuals must be processed inside KSA unless one of three exceptions applies: adequacy decision (SDAIA hasn't issued any yet), explicit and informed consent for the specific cross-border use, or SDAIA permit. For messaging, this means the SMSC, the campaign-management UI, and the DLR store must be in-kingdom. BroadNet operates a Riyadh DC specifically to keep customer data resident for KSA accounts.

## Consent requirements

Consent must be informed, specific, freely given, and provably recorded. For SMS marketing, that means an opt-in record (timestamp, source, exact consent text shown to the user) retained for 5 years. STOP keyword must be honoured within 24 hours and recorded. CST coordinates with SDAIA on sender-ID approval for marketing-classified messages — a sender ID without provable consent records gets revoked.

## What buyers should ask their aggregator

Three questions. Where is my SMSC physically located when I send to KSA numbers? Where are my DLRs and message bodies stored? What is the consent-record format and retention? Any answer involving Frankfurt, Dublin, or London is a non-starter for PDPL-compliant deployments.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [GDPR for messaging — what enterprise senders need to know](https://www.broadnet.me/answers/gdpr-for-messaging)
- [Sender ID registration in Saudi Arabia — the CST process](https://www.broadnet.me/answers/sender-id-registration-ksa-cst)
- [Compliance](https://www.broadnet.me/compliance)
- [KSA regulations](https://www.broadnet.me/regulations/saudi-arabia)