PDPL Article 38 empowers courts and regulatory committees to confiscate any financial gain derived from violations of the PDPL. It also allows for the public naming and shaming of violators—by publishing a summary of the final decision in local newspapers or through other appropriate channels—once all appeals are exhausted. The goal is to deter breaches through both financial and reputational consequences.
Saudi PDPL Article 38 (1)
Profit Confiscation
Without prejudice to the rights of bona fide third parties, the competent court may order the confiscation of funds obtained as a result of committing the violations stipulated in the Law.
Saudi PDPL Article 38 (2)
Public Violation Notice
The competent court, or the committee referred to in paragraph (2) of Article (36), as the case may be, may include in their penalty judgment or decision a provision that a summary of such judgment or decision shall be published at the expense of the violator in one (or more) local newspapers distributed in their area of residence, or using any other proper means. This is based on the type, seriousness and impact of the violation; provided that the publishing shall be after the judgment becomes final, the lapse of the deadline for appeals, or the issuance of a final ruling dismissing the appeal against the judgement.
Explanation of Saudi PDPL Article 38
Courts may confiscate gains from PDPL violations
Saudi PDPL Article 38 (1) says that, the competent court can seize money obtained through illegal personal data processing. Bona fide third parties are not affected by this provision.
Final decisions may be made public via local media or digital channels at the violator’s cost
Saudi PDPL Article 38 (2) says that, either the court or the PDPL enforcement committee (from Article 36) may order a public announcement of a violation after the final judgment, depending on severity and impact.
