Saudi PDPL for clinics: patient data, consent and where data must live

Short answer: Saudi Arabia's Personal Data Protection Law (PDPL) applies to clinics that process patient data in the Kingdom, and the Saudi Data & AI Authority (SDAIA) enforces it. Health data is sensitive data. The clinic is the controller: it needs explicit, documented consent unless the law allows another basis, a 72-hour breach process, a record of processing and registration with SDAIA. See how this applies to EMR software in Saudi Arabia.

This guide is information, not legal advice. Rules, guidance and dates change, so check with SDAIA or a lawyer before you act.

SDAIA's own guide has a clinic example: a nurse calls out a patient's name and reason for visit where other patients can hear. SDAIA calls it a bad practice, because both are personal data.

The law, its dates and its regulator

The PDPL (نظام حماية البيانات الشخصية) was issued by Royal Decree No. M/19 of 9/2/1443 AH (16 September 2021) and amended by Royal Decree No. M/148 of 5/9/1444 AH (27 March 2023). The detail sits in its Implementing Regulation and the Regulation on Personal Data Transfer Outside the Kingdom (version 2.0, August 2024).

SDAIA's guide says the law came into force on 14 September 2023, with a one-year grace period without penalties, and asked controllers to comply by 14 September 2024. The law is generally treated as enforceable since 14 September 2024.

The regulator, the law's Competent Authority, is SDAIA. Controllers in scope register, report breaches and record their DPO on its National Data Governance Platform. SDAIA can inspect and fine, and patients can complain to it.

Health data is sensitive data

PDPL Article 1 lists health data as sensitive data: any personal data about a person's physical, mental or psychological condition, or about health services they received. So diagnoses, notes, results, prescriptions and the fact of a visit are all sensitive.

PDPL Article 23 keeps access to medical files to the minimum number of staff, and only as needed to provide care. Implementing Regulation Article 26 asks the clinic to:

• Follow Ministry of Health, Saudi Health Council and Council of Health Insurance requirements.
• Build the law into internal policies.
• Separate duties and set access levels.
• Document each processing stage and who is responsible.
• Bind processors to the same measures.
• Keep processing to the minimum needed for care.

Processing sensitive data also needs a written impact assessment (Implementing Regulation Article 25). For security, the Implementing Regulation points to the National Cybersecurity Authority's controls where they apply, or recognized cybersecurity standards.

Consent

Consent is the default (PDPL Article 5). Under Implementing Regulation Article 11, it must be freely given, follow a clear explanation of the purpose, come from someone with full legal capacity, be documented with its time and means, and be separate for each purpose; for sensitive data, explicit. For a child or a patient lacking capacity, a verified legal guardian consents.

Consent can't be a condition of a service unless the service is directly tied to that processing (PDPL Article 7). Patients can withdraw it at any time, as easily as they gave it. Legitimate interest is never a basis for sensitive data. Other bases exist, such as another law or an agreement the patient is party to (PDPL Article 6); ask your lawyer which covers routine care.

For marketing, PDPL Article 25 allows advertising by post, email or other personal means of communication only with prior consent and a clear way to stop. Implementing Regulation Article 28 ties consent to recipients with no prior interaction; check with SDAIA how that applies to existing patients. PDPL Article 26 keeps sensitive data out of marketing, even with consent, as SDAIA's guide reads it. So don't pick campaign recipients by diagnosis or treatment.

Patient rights and time limits

PDPL Article 4 lists the rights; the Implementing Regulation sets the clock.

The extra 30 days need disproportionate effort or several requests from one patient, plus advance notice with reasons. Verify identity, log every request, including oral ones, and explain any refusal. Destruction doesn't override a legal retention period.

Breaches: 72 hours to SDAIA

Under Implementing Regulation Article 24, notify SDAIA within 72 hours of becoming aware of a breach that could harm the data, the patient, or their rights or interests. Describe what happened, the data and roughly how many patients, the risks and steps taken, whether patients were told, and a contact such as the DPO. Send anything missing as soon as possible, with reasons.

Tell affected patients without undue delay, in plain language, when the breach may harm their data, rights or interests. Reports due to the National Cybersecurity Authority or under other laws still apply.

Records, a DPO and the national register

Keep a written record of processing while it lasts and for five years after it ends, and show it to SDAIA on request (Implementing Regulation Article 33). It covers purposes, data and patient categories, retention, recipients, transfers abroad and security.

Implementing Regulation Article 32 requires a data protection officer (DPO) where a controller's core activities are based on processing sensitive data. A clinic can't treat patients without health data, so it likely needs one. That is a reading, not an SDAIA ruling: SDAIA's rules don't name clinics, so check with SDAIA or its DPO tool. The DPO can be an employee or a contractor.

SDAIA's rules for the National Register of Controllers require any controller that processes sensitive data to register on the National Data Governance Platform, as must an individual processing personal data beyond personal or family use. Anyone can verify a registration. Egypt's law differs: controllers and processors need a license or permit from its Personal Data Protection Center; see Egypt's data protection law for clinics.

Where patient data must live

The PDPL itself doesn't say data must stay in the Kingdom; it controls transfers out. PDPL Article 29 allows a transfer or disclosure abroad only for listed purposes, such as the Kingdom's interests or an obligation the patient is party to. The Transfer Regulation adds central processing operations, a service or benefit to the patient, and scientific research.

Each transfer must also meet three conditions: no harm to national security or the Kingdom's vital interests, protection abroad at least equal to Saudi law (as SDAIA assesses it), and minimum data. In the cases where the Transfer Regulation exempts a controller from the adequacy or minimum-data condition, safeguards apply instead, such as standard contractual clauses or binding common rules, and some routes are closed to sensitive data.

A risk assessment comes first for transfers under those exemptions, and for continuous or widespread transfers of sensitive data (Transfer Regulation Article 7). PDPL Article 29 lifts the three conditions in extreme necessity to preserve life or vital interests, or to prevent, examine or treat disease. Read that as a clinical exception, not a basis for hosting records abroad.

SDAIA's guide also notes that sector rules, such as healthcare's, apply on top of the PDPL. Check hosting limits with the Ministry of Health or your regulator before choosing a vendor that stores data abroad.

In October 2026, SDAIA invited public comment on draft amendments to the Implementing Regulation, including provisions on storing personal data. Law firms report that the draft would add an express duty to store personal data in the Kingdom, with lawful transfers still allowed. Check the text in force.

When you compare vendors, ask where patient data is stored.

Your software vendor is a processor

A vendor that hosts or processes patient records for you is a processor. Choose processors with sufficient guarantees and monitor them; your own responsibility stays (PDPL Article 8). Under Implementing Regulation Article 17, the agreement covers:

• Purpose, data categories and duration.
• Breach notice to you without undue delay.
• Whether foreign laws bind the vendor, and the impact.
• Disclosures Saudi law requires, reported to you.
• Subcontractors only with your prior approval.
• For health data, the Implementing Regulation Article 26 measures.

Give clear instructions and assess the vendor periodically. A vendor that breaks your instructions or the agreement is treated as a controller. For the wider buying checklist, see how to choose a clinic management system in Saudi Arabia.

Penalties

Disclosing or publishing sensitive data unlawfully, to harm the patient or for personal benefit, carries up to two years in prison, a fine of up to SAR 3,000,000, or both (PDPL Article 35). Other violations carry a warning or a fine of up to SAR 5,000,000, decided by an SDAIA committee and open to appeal in court (PDPL Article 36). Repeat offenses can double the fine.

Where Helix fits

Software can make these duties easier, but it can't take them over. Compliant software doesn't make a clinic compliant: the clinic stays the controller, and its consent records, registration, DPO decision, impact assessment and breach reports remain its own.

Helix is compliant with the Saudi PDPL, NCA cybersecurity controls and CHI/NPHIES requirements. Saudi clinics' data is stored in Saudi Arabia. Helix encrypts data in transit and at rest, uses role-based access and keeps full audit logs; the Helix security page describes these controls. The clinic still decides who holds which role. Verto, Helix's AI, runs in Helix's own cloud, never on third-party AI APIs, and customer data is never used for training.