PDPL Article 35 establishes the penalties for general violations of the PDPL or its implementing regulations, except those specifically covered under Article 35 (i.e., unlawful sensitive data disclosure). It introduces administrative penalties such as warnings and fines, outlines the enforcement process, and provides appeal rights. It also specifies the structure and authority of the violation review committee formed by the Competent Authority (SDAIA).
Saudi PDPL Article 36 (1)
Fines for General Violations
In cases that are not covered in Article (35) herein and without prejudice to any harsher penalty stipulated in another law, a warning or a fine not exceeding (five million) Riyals shall be imposed on every person with a special natural or legal capacity – covered by the provisions of the Law – who violates any of the provisions of the Law or the Regulations. The fine penalty may be doubled in the event of a repeat violation, even if it results in exceeding its maximum limit, provided that it does not exceed double this limit.
Saudi PDPL Article 36 (2)
Violation Committee Rules
A committee (or more) shall be formed by a decision of the president of the Competent Authority. The number of its members shall not be less than (three), and one of them shall be appointed as the committee head, and there shall be a technical specialist and a legal advisor among them. The committee is to examine violations and issue warnings or impose fines as stipulated in Paragraph (1) of this Article, considering the type of violation committed, its seriousness and the extent of its impact; provided that the decision of the committee is approved by the president of the Competent Authority or whomever they delegate. The president of the Competent Authority shall issue, by their decision, the rules of work of the committee, and the remunerations of its members shall be determined therein.
Saudi PDPL Article 36 (3)
Right to Appeal
Anyone against whom a decision has been issued by the committee mentioned in Paragraph (2) of this Article has the right to appeal against them before the competent court.
Explanation of Saudi PDPL Article 36
General PDPL breaches may lead to financial penalties
Saudi PDPL Article 36 (1) says that, anyone (natural or legal person) who violates the PDPL or its regulations can be fined up to SAR 5 million, unless a harsher penalty is stated in another law. Fines may be doubled for repeat offenses.
A specialized committee will decide on violations and penalties
Saudi PDPL Article 36 (2) says that, a committee of at least 3 members (including a legal advisor and technical expert) will review violations and impose penalties. The committee’s work must be approved by SDAIA’s president or delegate.
Violators can challenge the committee’s decisions in court
Saudi PDPL Article 36 (3) says that, anyone penalized by the committee has the right to appeal the decision before the competent court.
