KSA PDPL » Saudi PDPL Article 38 – Competent Court Confiscation and Public Disclosure

Saudi PDPL Article 38 – Competent Court Confiscation and Public Disclosure

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 10, 2025
Updated: January 11, 2026

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 38 empowers the competent court to confiscate any financial gains obtained unlawfully through violations of the Personal Data Protection Law (PDPL). It also authorizes the public disclosure of final judgments, allowing courts or the enforcement committee to publish a summary of the violation in local newspapers or other approved channels once all appeals are exhausted.

This Article reinforces deterrence by combining financial penalties with reputational impact. By making violations public, it strengthens accountability, discourages repeated offenses, and promotes transparency within the Kingdom’s data protection ecosystem.

SDAIA's Official PDPL Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 38

Without prejudice to the rights of bona fide third parties, the competent court may order the confiscation of funds obtained as a result of committing the violations stipulated in the Law.

The competent court, or the committee referred to in paragraph (2) of Article (36), as the case may be, may include in their penalty judgment or decision a provision that a summary of such judgment or decision shall be published at the expense of the violator in one (or more) local newspapers distributed in their area of residence, or using any other proper means. This is based on the type, seriousness and impact of the violation; provided that the publishing shall be after the judgment becomes final, the lapse of the deadline for appeals, or the issuance of a final ruling dismissing the appeal against the judgement.

Plain-Language PDPL Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

PDPL Article 38(1)

Illegal Gains Confiscated

This provision states that courts may confiscate any financial gains earned from PDPL violations. This confiscation must not infringe on the rights of bona fide third parties. The intent is to ensure violators do not profit from unlawful personal data processing.

PDPL Article 38(2)

Judgment Publication Authorized

This provision allows the competent court, or the Article 36 enforcement committee, to order the publication of a summary of the final judgment. This publication may appear in local newspapers or any other appropriate medium, and the violator must bear the cost.

Publication may only occur after the judgment becomes final, appeal periods expire, or an appeal is finally dismissed. This is intended to promote accountability and deter future violations.

Frequently Asked Questions (FAQs)

Does Article 38 of the Saudi Personal Data Protection Law (KSA PDPL) mean every violation goes to court?

No, court involvement applies only to certain types of violations defined under the law. Many PDPL issues are handled administratively by SDAIA without court escalation.

When does a PDPL case typically get referred to a competent court?

It is usually when the violation falls within categories that require judicial review. Article 38 confirms that some matters must be handled by the court rather than SDAIA alone.

Can the court order confiscation of devices or systems involved in a PDPL violation?

Yes, Article 38 allows confiscation of tools or proceeds related to the violation. The purpose is to prevent ongoing misuse of Personal Data.

Does “public disclosure” under Article 38 mean naming and shaming companies in all cases?

Not automatically, as disclosure occurs only when the court orders it. This is typically used in more serious or impactful violations.

If an employee acted improperly with Personal Data, does Article 38 apply to the individual or the company?

It can apply to both depending on the case. Courts look at responsibility across individuals and entities involved.

Can the court’s confiscation order affect cloud based or SaaS environments?

Potentially yes, if the systems or tools are directly linked to the violation. Article 38 focuses on the means of committing the violation rather than the hosting model.

Does Article 38 involve compensation claims by affected individuals?

Article 38 itself focuses on judicial authority, confiscation, and disclosure. Compensation claims may exist elsewhere in PDPL but are not addressed in this article.

Common misconception, “confiscation only applies to physical items.” Is that correct?

No, confiscation can include digital tools or assets tied to the violation. The scope is not confined to physical hardware.

Can a company challenge a court ordered confiscation under Saudi PDPL?

Yes, like any judicial decision, it follows the normal court process. Article 38 does not remove the right to legal challenge.

If a small business unintentionally mishandles data, will Article 38 penalties automatically apply?

Not necessarily, as the court is typically used for specific categories of violations. Many unintentional issues are handled through SDAIA’s administrative powers instead.

Does Article 38 give SDAIA the power to publicly announce violations on its own?

No, public disclosure under Article 38 requires a court order. SDAIA’s enforcement powers are addressed separately in Article 37.

Yes, if the court determines it is connected to the violation. Article 38 allows confiscation of proceeds resulting from improper Personal Data use.