Understanding PDPL Data Subject Rights
Saudi Arabia's Personal Data Protection Law (PDPL) establishes a comprehensive framework for protecting individual privacy. At its core are data subject rights—fundamental protections that empower individuals to control how their personal data is collected, used, and retained by organizations. Understanding these rights is essential for businesses operating in the Kingdom and for individuals seeking to exercise their rights under the law.
Residents of the Kingdom of Saudi Arabia, called data subjects, are given a number of data rights under the PDPL. These rights form the cornerstone of PDPL compliance and reflect the law's commitment to transparency, fairness, and individual autonomy. This guide walks you through each right, explains how to exercise them, and provides actionable guidance for data controllers managing these requests.
The Four Core PDPL Data Subject Rights
1. Right to Access Your Personal Data
Data subjects have the right to access their personal data, and the right to receive a copy of their personal data in an easily readable format and free of charge. This right is foundational—it allows individuals to know what information organizations hold about them and how it's being used.
What Does This Cover?
- A complete copy of all personal data held by the controller
- Information about what categories of data are processed
- Details on how the data is being used and for what purposes
- Free provision of the data copy (no fees permitted)
- Delivery in a readily understandable format
Practical Example for Businesses: An e-commerce company receives a data access request from a customer. The customer wants to know what data the company holds. The business must compile all customer records—including purchase history, account information, contact details, browsing activity, and communication records—and provide it within 30 days at no cost. The company should document this request and the response provided.
2. Right to Correction (Rectification)
Data subjects have the right to request entities to correct, update, or complete personal data about them. Accuracy is critical; outdated or incomplete information can harm individuals and lead to poor business decisions.
What Can Be Corrected?
- Inaccurate personal information (e.g., misspelled names, wrong contact details)
- Incomplete data that should be supplemented
- Outdated information that no longer reflects the individual's current status
- Conflicting information across systems
Controller Obligations After Correction: After the correction of the personal data, the Controller shall, without undue delay, notify the parties to whom the personal data was previously disclosed. This means if inaccurate data was shared with third parties, those parties must be informed of the correction.
Practical Example for Businesses: A bank receives a correction request from a customer whose address is incorrect in their account. The bank must verify the request, update the address in all relevant systems, and notify any third parties that previously received the inaccurate address (such as credit bureaus or loan servicers). This should be completed within 30 days.
3. Right to Deletion (Right to Be Forgotten)
Data subjects have the right to request the deletion of personal data if the entities no longer need it. This right is particularly powerful—it allows individuals to request that their data be permanently removed when it's no longer required.
When Can Deletion Be Requested?
The Controller is under obligation to destroy personal data in the following circumstances: When the data subject has made a request for the personal data to be destroyed. When the personal data is no longer necessary for the purpose it was collected. If the data subject withdraws his/her consent for the processing of the personal data and the consent is the sole legal basis for processing.
Deletion vs. Retention Exceptions: Not all data can be deleted on demand. Controllers may retain data if:
- Legal obligations require it (e.g., tax records, audit trails)
- An alternative legal basis for processing exists
- The data is necessary for ongoing legitimate purposes
- The data has been anonymized or pseudonymized
Practical Example for Businesses: A fitness app receives a deletion request from a user who wants their account closed. The app must delete the user's profile, workout history, payment details, and any personal identifying information—unless the company has a legal obligation to retain certain records (such as billing records for tax compliance). The deletion should be completed within 30 days, and the user should receive confirmation.
4. Right to Data Portability
The data subjects can obtain their personal data in a legible and clear format and request their personal data to be transferred to another controller. Data portability reduces vendor lock-in and empowers individuals to move between service providers.
What Does Portability Require?
- Data provided in a structured, commonly used, machine-readable format
- Data delivered directly to the individual or transmitted to another controller if requested
- Organization and clarity of data presentation
- No additional fees or barriers to the transfer
Practical Example for Businesses: A cloud storage company receives a portability request from a user who wants to switch to a competitor. The company must export the user's files, folder structures, metadata, and any associated information in a standard format (such as CSV or JSON) and either deliver it to the user or directly transfer it to the new service provider they specify, all within 30 days.
Controller Obligations: The 30-Day Response Rule
The data controller must fulfill these requests within 30 days and record all data subject requests received. This is a hard deadline that applies to all data subject rights requests—access, correction, deletion, and portability.
Extension Scenario: Data controllers must respond to any requests they receive from data subjects regarding their rights within 30 days. If necessary, this time period may be extended for up to an additional 30 days. Extensions are only permitted in specific circumstances, such as when a controller receives multiple complex requests or if the complexity of fulfilling the request genuinely requires additional time.
Key Controller Obligations
The data controller is required to ensure that all data subjects are appropriately informed about these rights and establish dedicated channels for data subjects to exercise these rights. This means:
- Clear Communication: Privacy notices must explicitly describe each data subject right
- Accessible Channels: Multiple methods for submitting requests (email, web form, phone, in-person)
- Documentation: Record all requests received and responses provided
- No Discrimination: Do not charge fees or impose barriers to exercising rights
- Training: Staff must understand these obligations and handle requests professionally
How to Exercise Your Data Subject Rights
If you're a resident of Saudi Arabia wanting to exercise your rights:
- Identify the Controller: Determine which organization holds your data. Check their privacy notice or contact information.
- Submit Your Request: Use the channel provided by the organization (email, online form, etc.). Be clear about which right you're exercising (access, correction, deletion, or portability).
- Provide Required Information: Include sufficient details to identify yourself (name, account number, email, etc.)
- Document Everything: Keep copies of your request and any responses received
- Follow Up: If 30 days pass without response, escalate to the Saudi Data & Artificial Intelligence Authority (SDAIA)
Practical Compliance for Businesses
Building a Data Subject Rights Request System
Responding to requests within 30 days requires infrastructure and processes:
- Request Intake: Establish a centralized channel (dedicated email, web portal) for receiving requests
- Classification: Determine the type of request (access, correction, deletion, portability) and the urgency
- Verification: Confirm the requestor's identity before fulfilling sensitive requests
- Data Location: Identify all systems and locations where the individual's data is stored
- Fulfillment: Execute the request across all systems where data is held
- Documentation: Record the request details, response date, and method of fulfillment
- Response: Communicate the outcome to the data subject within 30 days
Establish internal workflows for handling access, correction, deletion, and portability requests. Train staff (HR, customer service, IT) to recognize and escalate any such requests. Remember: responses must be given within 30 days, and requests themselves must be logged (document the request and how you fulfilled it).
Handling Data Access Requests: Step-by-Step
Day 1-2: Receive request, verify requestor identity, log the request in your tracking system
Day 3-5: Identify all systems containing the individual's data (CRM, databases, email archives, backup systems, etc.)
Day 6-20: Extract and compile data, remove sensitive information unrelated to the requestor, organize in readable format
Day 21-28: Prepare response (digital or physical copy), draft cover letter explaining what was provided
Day 29-30: Deliver response to requestor via secure channel, retain proof of delivery
Handling Deletion Requests: Key Considerations
Deletion is more complex than access. Before deleting data, verify:
- The data subject's identity and authority to make the request
- Any legal, contractual, or regulatory requirements to retain the data
- Whether the data is referenced in other systems or backups
- The safe deletion method (secure wiping, not just file removal)
Data controllers and processors must delete any personal data that is no longer needed. This includes ensuring third-party processors also delete the data or provide evidence of deletion.
Enforcement and Penalties
Non-compliance with PDPL data subject rights obligations is taken seriously. The Saudi Data & Artificial Intelligence Authority (SDAIA) will be the primary body responsible for enforcing the PDPL within Saudi borders. Organizations that fail to respond to requests within 30 days, provide inaccurate information, or discriminate in honoring rights face significant penalties.
To stay compliant and avoid enforcement action, review the SDAIA PDPL Enforcement Cases 2025-2026 for real violations and penalties explained. Understanding what regulators are focusing on helps you prioritize your compliance efforts.
Integration with Overall PDPL Compliance
Data subject rights are one pillar of PDPL compliance. They must be integrated with your broader compliance program, including:
- Controller Registration: First-time registrants should follow the PDPL Data Controller Registration on SDAIA Platform: Step-by-Step Compliance Guide 2026
- Legal Basis Establishment: Ensure you have a valid legal basis before processing any data
- Privacy Notices: Inform individuals of their rights upfront, not only when they request them
- Data Protection Officer (DPO): If required, appoint a DPO to oversee compliance
- Cross-Border Transfers: Apply additional safeguards if transferring data outside Saudi Arabia
- Breach Notification: Establish procedures to report breaches to SDAIA within 72 hours
For the latest updates on PDPL compliance trends and regulatory guidance, visit our blog for the latest articles on Saudi Arabia's Personal Data Protection Law.
Conclusion
PDPL data subject rights represent a significant shift in how organizations must treat personal data in Saudi Arabia. The rights to access, correction, deletion, and portability are not optional—they're mandatory obligations. The 30-day response window is strict, and SDAIA actively enforces compliance.
Organizations that proactively build data subject rights capabilities into their operations gain several advantages: they build customer trust, reduce the risk of regulatory enforcement, and position themselves as responsible data stewards in Saudi Arabia's evolving privacy landscape. Individuals, meanwhile, now have tangible tools to control their personal information and hold organizations accountable.
Whether you're implementing these rights for the first time or refining your existing processes, the key is to view data subject rights not as a compliance burden, but as an opportunity to strengthen your relationship with customers and demonstrate your commitment to privacy protection under the PDPL.