Medoc HMS
Request Demo
SAUDI ARABIA COMPLIANCE GUIDE

PDPL and Healthcare Data in Saudi Arabia: A Practical Guide

The Personal Data Protection Law (PDPL) is Saudi Arabia's general data protection law, regulated by the Saudi Data and Artificial Intelligence Authority (SDAIA). It treats health data as sensitive personal data, requiring a lawful basis, explicit consent for sensitive processing, data minimisation, defined retention, and breach-handling procedures. It governs how a clinic collects, stores and shares patient data, not just how software is configured.

Written by the Medoc HMS team · Last updated 14 October 2026 · Last reviewed 14 October 2026

PDPL compliance is a legal responsibility that sits with the clinic as the data controller, not with any single piece of software. This guide explains what the law actually requires for health data and where software like Medoc HMS can and cannot help.

What is the PDPL?

The Personal Data Protection Law (PDPL) is Saudi Arabia's general data protection law, issued by Royal Decree and later amended. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulator responsible for it. Reputable secondary legal sources place the law's full enforcement date in September 2024, following a 2023 amendment, though this guide could not independently confirm the exact dates from SDAIA's own site during research; confirm the current effective dates directly with SDAIA.

The Saudi Ministry of Health's own privacy page, which this guide was able to verify directly, describes how the Ministry processes personal data under the PDPL and treats health-related records as sensitive data requiring extra protection.

Which clinics does the PDPL apply to?

The PDPL governs personal data processing connected to individuals inside Saudi Arabia. Secondary legal analysis describes this as applying to any organisation processing personal data of individuals in the Kingdom, regardless of where the organisation itself is registered, though this guide could not independently confirm that scope statement from SDAIA directly. Health data is explicitly called out as sensitive data under the law, which means clinics handling patient records are squarely within its scope as data controllers.

What does the PDPL require for healthcare data?

The Ministry of Health's privacy page sets out the obligations it follows under the PDPL, which give a reliable picture of what a healthcare data controller needs to address:

  • A lawful basis for processing: contractual obligation, legal compliance, public interest, vital interests, legitimate interest, or consent.
  • Explicit consent specifically for sensitive or specialised treatment data.
  • Purpose limitation: data used only for the purpose it was collected for.
  • Defined retention periods, with secure deletion or anonymisation afterward.
  • A designated person responsible for data protection oversight.
  • A documented position on where data is stored and how any transfer outside Saudi Arabia is handled.

Secondary legal sources also describe a breach-notification obligation to SDAIA within a short window after discovery, and potential financial penalties for serious violations. This guide could not independently confirm the exact notification window or penalty figures from SDAIA directly, so they are not stated here as settled facts; confirm both with SDAIA or qualified legal counsel before relying on a specific number.

How does a clinic connect or register?

  1. Map what patient data your clinic collects, stores and shares, and identify the lawful basis for each use.
  2. Put a consent process in place for sensitive health data, separate from general consent to treatment.
  3. Define retention periods for patient records and a process for secure deletion or anonymisation when they expire.
  4. Decide where patient data is stored and hosted, and document how any cross-border transfer is handled.
  5. Appoint a person or role responsible for data protection within the clinic.
  6. Check whether your clinic needs to register as a controller on SDAIA's National Data Governance Platform. Secondary sources describe this as required for certain categories of controller, including those processing sensitive personal data as a primary activity, but confirm your specific obligation with SDAIA.

What happens if a clinic is not compliant?

Secondary legal sources report that SDAIA can impose financial penalties for serious PDPL violations, reported in some analyses at up to SAR 5 million. This guide could not independently confirm the current penalty structure from SDAIA directly, so treat this as a reported figure to verify, not a confirmed cap. Patients also have a right to complain to SDAIA about how their data is handled; the Ministry of Health's own page states that complaints are addressed within 15 working days.

How Medoc HMS supports PDPL readiness

Medoc HMS supports configurable data residency and access controls relevant to PDPL obligations. The platform includes role-based access, permissions and audit logs, so a clinic can control and trace who accesses patient data, and data encryption, regular backups and disaster recovery as part of its security features. Medoc HMS is offered as cloud or on-premise, which affects where your data is hosted.

PDPL compliance is the clinic's responsibility as data controller. Software is one input into that, not a substitute for it. Talk to us about your data residency and access-control requirements, and confirm your legal obligations with SDAIA or qualified counsel.

Frequently asked questions

Is Medoc HMS PDPL compliant?

PDPL compliance applies to the clinic as the data controller, not to a software vendor. Medoc HMS supports configurable data residency and access controls, role-based permissions, audit logs, encryption and backups, which are relevant to PDPL obligations, but compliance itself is the clinic's responsibility.

Does the PDPL require patient data to stay inside Saudi Arabia?

The Ministry of Health's own privacy page says cross-border transfers are governed by the PDPL and its executive regulations, without stating a blanket localisation rule on that page. Confirm current data residency requirements with SDAIA, since this can depend on the type of data and controller.

What counts as sensitive data under the PDPL?

The Ministry of Health's privacy page defines sensitive data as including health-related records or data that indicate an individual's health condition, alongside categories like biometric data.

Who enforces the PDPL?

The Saudi Data and Artificial Intelligence Authority (SDAIA) is the regulator responsible for the PDPL. Patients can also complain to SDAIA about how their data is handled.

Related

Sources