Past Roundtable September 9, 2026
Regulatory Enforcement Roundtable II: From Understanding Enforcement to Demonstrating Compliance
PDPL enforcement in Saudi Arabia has moved from awareness to active audit, and organizations of every size are now being asked for evidence rather than intent. In this second Pyxos enforcement roundtable, Basmah Alsubaie, Richard Chudzynsky and Tahir Latif compared what they have seen since May: corrective action notices with fixed deadlines, periodic audits that return to verify remediation, sector regulators building their own inspection capability, and a public that reports violations directly to SDAIA. The discussion set out how an inspection opens and what is requested first, why sanctioned organizations are not yet named and when that is likely to change, the early signs of private litigation and extraterritorial enforcement, and why AI adoption is forcing the budget conversation the DPO could not win alone.
Presenters
Basmah Alsubaie
CEO, Privacy Professionals
Richard Chudzynsky
Partner, KONEXO/Eversheds Sutherland
Tahir Latif
IAPP Country Leader, UAE, KSA & Qatar
Recording
Delivered live — no recording available for roundtable sessions to encourage candid exchange.
Read the Blog PostKey takeaways
- SDAIA has shifted from awareness campaigns to enforcement action: audits, evidence requests, corrective action notices, and in some cases suspending non-compliant features within live applications.
- Enforcement is not selective by size. The panel cited ministries and public authorities alongside a thirty-patient clinic instructed to appoint a DPO within a set deadline.
- Following the 48 decisions published in January 2026, a further round of penalties in June widened the enforced scope to organizations without a DPO, unreported breaches, and unanswered data subject requests.
- Cross-border transfers and data inventory have drawn the most scrutiny since May: regulators want to know where personal data sits and which safeguards apply.
- The audit approach has hardened. Eighteen months ago it was a questionnaire and gap assessment; regulated financial entities now face unannounced visits and audits every three to six months, with findings, deadlines, and a return visit to verify corrective action.
- No enterprise client of the panel has received a fully clean audit result. The follow-up work to close findings on deadline is now the main pressure on privacy teams.
- Examiners have become technically fluent: they ask where SaaS platforms are hosted, where backups reside, whether data leaves the Kingdom, and how personal data is used in AI models.
- SDAIA does not yet publish the names of sanctioned organizations. The panel expects it to follow the Ministry of Commerce's e-commerce precedent and begin naming repeat violators as its practice matures.
- Extraterritorial enforcement is being actively pursued against foreign organizations processing the personal data of individuals in the Kingdom.
- Article 36 of the PDPL sets fines up to SAR 5 million, doubled for repeat violations; Article 35 adds imprisonment and fines up to SAR 3 million for unlawful disclosure of sensitive data.
- Private litigation for breaches is nascent but expected to grow, following the UK pattern where access requests now generate substantial litigation volume.
- Public awareness is a live enforcement channel. Individuals report suspected violations on social media and tag SDAIA directly, and a single campaign can force executive attention overnight.
- Sector regulators are maturing in parallel: SAMA and the Insurance Authority run their own audits, healthcare regulators have markedly increased activity, and a breach may require notifying several authorities at once.
- SAMA audits now ask whether a privacy technology platform is in place; it is not mandated, but a negative answer lowers the score.
- On a first inspection, SDAIA asks for the RoPA, the data inventory, and data mapping evidence. A complaint, incident, or breach triggers an entirely different set of questions, and every valid complaint is investigated.
Frequently Asked Questions
Yes. The panel described enforcement reaching entities of every size, including a small clinic with around thirty patients that was instructed to appoint a DPO within a fixed timeframe or face a legal case. The regulator is not categorizing by size or sector when issuing evidence requests, and organizations of all kinds are receiving the same questions.
The opening request is typically the Record of Processing Activities (RoPA), the data inventory, and any data discovery and mapping documentation showing where personal data is held and what safeguards apply. Regulators check whether the RoPA is current, whether the lawful basis is correct, and which data elements are collected. If the inspection follows a complaint, incident, or breach, the evidence set changes entirely.
Not yet. Enforcement decisions and penalties have been issued and summarized, but individual organizations are not named. The panel expects SDAIA to follow the pattern the Ministry of Commerce established with e-commerce enforcement and begin publishing the names of repeat violators once its enforcement practice has matured, consistent with international regulatory practice.
Under Article 36 of the PDPL, violations can attract a warning or a fine of up to SAR 5 million, doubled for repeat offences. Under Article 35, unlawful disclosure of sensitive personal data with intent to harm can carry imprisonment of up to two years and a fine of up to SAR 3 million. These are the statutory ceilings; the panel noted that actual penalties issued to date have not been published with the names of the organizations involved.
Yes. Article 2 of the PDPL applies to any processing of personal data relating to individuals residing in the Kingdom, including processing by entities located outside it. The panel reported that this extraterritorial reach is now being actively pursued, so foreign organizations serving Saudi residents should expect the same evidence requests as domestic ones.
Yes. Article 40 of the PDPL gives anyone who suffers harm from a violation the right to claim compensation before the competent court, alongside the administrative penalties SDAIA imposes. Private litigation is still nascent in the Kingdom, but the panel expects it to grow as public awareness rises, following the path seen in the UK and EU where access requests and breach claims now drive significant case volume.