KSAPDPL.COM

Table of Contents

Saudi PDPL Article 1 – Definitions
Saudi PDPL Article 2 – Scope of Personal Data Processing
Saudi PDPL Article 3 – Additional Rights Protection
Saudi PDPL Article 4 – Data Subject Rights (DSR)
Saudi PDPL Article 5 – Consent Requirements for Processing
Saudi PDPL Article 6 – Consent Exceptions for Processing
Saudi PDPL Article 7 – No Forced Consent
Saudi PDPL Article 8 – Controller Obligations for Processors
Saudi PDPL Article 9 – Limits on Access Rights
Saudi PDPL Article 10 – Exceptions to Direct Collection Rule
Saudi PDPL Article 11 – Purpose and Collection Limits
Saudi PDPL Article 12 – Privacy Policy Requirements
Saudi PDPL Article 13 – Personal Data Collection Disclosure Requirements
Saudi PDPL Article 14 – Personal Data Accuracy Obligation
Saudi PDPL Article 15 – Permitted Personal Data Disclosure Conditions
Load More

Saudi PDPL Article 38 – Competent Court Confiscation and Public Disclosure

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 38 empowers the competent court to confiscate any financial gains obtained unlawfully through violations of the Personal Data Protection Law. It also authorizes the public disclosure of final judgments, allowing courts or the enforcement committee to publish a summary of the violation in local newspapers or other approved channels once all appeals are exhausted.

This Article reinforces deterrence by combining financial penalties with reputational impact. By making violations public, it strengthens accountability, discourages repeated offenses, and promotes transparency within the Kingdom’s data protection ecosystem.

Saudi PDPL Article 38

  1. Without prejudice to the rights of bona fide third parties, the competent court may order the confiscation of funds obtained as a result of committing the violations stipulated in the Law.
  2. The competent court, or the committee referred to in paragraph (2) of Article (36), as the case may be, may include in their penalty judgment or decision a provision that a summary of such judgment or decision shall be published at the expense of the violator in one (or more) local newspapers distributed in their area of residence, or using any other proper means. This is based on the type, seriousness and impact of the violation; provided that the publishing shall be after the judgment becomes final, the lapse of the deadline for appeals, or the issuance of a final ruling dismissing the appeal against the judgement.

Explanation of Saudi PDPL Article 38

Article 38(1)

Illegal Gains Confiscated

This provision states that courts may confiscate any financial gains earned from PDPL violations. This confiscation must not infringe on the rights of bona fide third parties. The intent is to ensure violators do not profit from unlawful personal data processing.

Article 38(2)

Judgment Publication Authorized

This provision allows the competent court, or the Article 36 enforcement committee, to order the publication of a summary of the final judgment. This publication may appear in local newspapers or any other appropriate medium, and the violator must bear the cost.

Publication may only occur after the judgment becomes final, appeal periods expire, or an appeal is finally dismissed. This is intended to promote accountability and deter future violations.

Related PDPL Regulations, Rules & Guidelines​

Saudi Personal Data Protection Law Compliance Services (KSA PDPL)

KSA PDPL Compliance Implementation

Achieve PDPL Compliance in 4 weeks or less.

Data Protection Officer As A Service (DPOaaS)

Let us handle your daily PDPL Compliance Operations.

KSA PDPL Compliance Audit (External)

Audit your PDPL compliance obligations.

Scroll to Top