Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 43 establishes the formal enforcement date of the Personal Data Protection Law. The Law becomes fully effective 720 days after publication in the Official Gazette. This transition period gives controllers and processors time to operationalize their compliance programs, update internal processes, and align governance structures with PDPL obligations.
Once the enforcement date arrives, all rights, duties, penalties, and oversight mechanisms under the PDPL apply without exception, marking the beginning of full legal accountability across the Kingdom.
Saudi PDPL Article 43
This Law shall come into force after (seven hundred and twenty) days commencing on the date of its publication in the Official Gazette.
Explanation of Saudi PDPL Article 43
PDPL Enforcement Timeline Final
This provision confirms that the PDPL becomes legally enforceable exactly 720 days after it is published in the Official Gazette. Once this period ends, the Law applies fully to all entities processing personal data within the Kingdom or processing the data of individuals residing in Saudi Arabia.
This means every obligation, penalty, accountability mechanism, and compliance requirement under the PDPL is activated from that enforcement date onward.
