KSA PDPL » Saudi PDPL Article 40 – Right to Compensation for Material or Moral Damages

Saudi PDPL Article 40 – Right to Compensation for Material or Moral Damages

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 10, 2025
Updated: January 11, 2026

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 40 grants individuals the legal right to claim compensation if they suffer material or moral harm due to a violation of the Personal Data Protection Law (PDPL) or its Implementing Regulations. This includes harm caused by unlawful disclosure, improper processing, or any violation that results in damage.

The Article enables harmed individuals to file a claim before a competent court, which will examine the case, determine liability, and award proportionate compensation. This right operates independently of any penalties imposed under the PDPL, ensuring full accountability for unlawful processing and comprehensive redress for affected individuals.

SDAIA's Official PDPL Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 40

Without prejudice to the penalties stated in this Law, any individual that suffers a damage as a result of any of the violations stated in this Law or the Regulations may apply to a competent court for proportionate compensation for the material or moral damage.

Plain-Language PDPL Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

Seek Proportionate Compensation

This provision establishes that any individual who suffers harm, financial, emotional, or reputational, because of a PDPL violation may file a compensation claim before a competent court. The court will determine proportionate compensation based on the extent of the material or moral harm suffered.

This right applies even when administrative or criminal penalties have already been imposed on the controller or processor, ensuring individuals receive full redress for the consequences of improper processing.

Frequently Asked Questions (FAQs)

Can I claim compensation under the Saudi Personal Data Protection Law (KSA PDPL) if my data was mishandled but I did not suffer financial loss?

Yes, Article 40 covers both material and moral damages. A court typically evaluates whether harm occurred and what compensation is appropriate.

Does every PDPL violation automatically give me a right to compensation?

No, compensation depends on proving that a violation caused actual harm. The court determines whether the harm is linked to the incident.

Who is responsible for paying compensation under Article 40?

The controller or entity responsible for the harmful processing is typically liable. The court decides based on the circumstances of the case.

Can I claim compensation from a processor directly?

In practice, claims are usually directed at the controller, but processors can be involved depending on their role in the harmful act. The court evaluates their responsibility.

Is emotional distress considered “moral damage” under Article 40?

It can be, as moral damage includes non-financial harm. The court determines whether distress meets the threshold for compensation.

Does Article 40 require me to file a complaint with SDAIA before going to court?

The article does not require a specific sequence. Individuals may pursue compensation through the competent court.

Can employees claim compensation from their employer under the Saudi PDPL?

Yes, if the employer acted as a controller and caused harm through improper processing. The case would be evaluated like any other PDPL-related harm claim.

Is compensation guaranteed if my data was leaked in a breach?

Not automatically. You must show that the breach resulted in material or moral harm.

Can multiple people affected by the same incident each seek compensation?

Yes, each affected individual may pursue their own claim. The court assesses each person’s harm independently.

Does Article 40 cap the amount of compensation?

The article does not set specific limits. The competent court decides the appropriate compensation.

If a company unintentionally mishandles my data, can I still claim moral damages?

Yes, intent is not required. The key question is whether the mishandling caused harm.

Is a common misconception that compensation is handled by SDAIA?

Yes, many assume SDAIA awards compensation, but Article 40 makes clear that only the competent court grants it.