Key Takeaways
- Consent is the default basis under the PDPL, but other lawful bases include compliance with legal obligations, contractual necessity, and legitimate interests
- The PDPL recognizes six distinct lawful bases, giving organizations flexibility beyond consent-based processing
- Processing may be necessary for the controller's legitimate interest, provided this doesn't prejudice the rights and interests of the data subject and doesn't involve sensitive data
- Each lawful basis requires careful documentation and assessment to demonstrate compliance with SDAIA
- Misidentifying or misapplying a lawful basis exposes your organization to enforcement action and penalties
- A decision tree approach helps determine which lawful basis applies to your specific processing activity
Introduction
The Saudi Personal Data Protection Law (PDPL) fundamentally changed how organizations approach data processing in the Kingdom. While consent remains the default legal foundation for most processing activities, the PDPL provides multiple alternative lawful bases that allow organizations to process personal data without explicit consent in specific circumstances.
Understanding these lawful bases is critical. Organizations that misidentify or misapply a lawful basis risk enforcement action by SDAIA, damage to customer trust, and operational disruptions. This guide walks you through all six lawful bases under the PDPL, explains how to apply each one, and provides decision frameworks to help you classify your processing activities correctly.
The Six Lawful Bases Under PDPL
While consent is the default basis under the PDPL, other lawful bases include compliance with a legal obligation; contractual necessity (based on a prior agreement); and legitimate interests (excluding sensitive data). Beyond these, the PDPL recognizes three additional bases: vital interests, public task, and processing necessary for contract formation or execution.
1. Consent (Default Basis)
PDPL is more restrictive than GDPR on the use of legitimate interests as a standalone basis, and it places significant weight on explicit consent for non-essential processing. When you rely on consent as your lawful basis, you must follow the PDPL's strict consent requirements.
When to use consent:
- Direct marketing and promotional communications
- Non-contractual use of personal data
- Processing of sensitive personal data (in most cases)
- Uses that fall outside the scope of other lawful bases
Key compliance requirements:
- Consent must be freely given, specific, and unambiguous
- Obtain consent before processing begins (with narrow exceptions)
- Use clear, plain language; avoid buried or default consent mechanisms
- Record and maintain evidence of consent
- Allow easy withdrawal of consent at any time
For detailed guidance on consent mechanics, see our post on PDPL consent requirements: valid consent vs. freely given consent.
2. Contract Performance
Contractual necessity refers to fulfilling contractual obligations. This is one of the most straightforward lawful bases to apply—if processing is necessary to perform a contract you have with the data subject, you can process without additional consent.
Examples:
- Processing a customer's name, address, and payment details to fulfill an e-commerce order
- Collecting employee salary and banking information to pay wages
- Processing customer contact details to provide after-sales support
- Storing delivery address to ship goods ordered online
Critical limitation: You can only process personal data that is necessary for contract performance. Collecting "just in case" data or using contractual necessity to justify unrelated processing violates the PDPL's data minimization principle.
3. Legal Obligation
When processing data becomes a legal necessity, data controllers should collect personal data without seeking user consent. If Saudi law, sector-specific regulation, or a court order requires you to process specific personal data, legal obligation is your lawful basis.
Examples:
- Collecting and storing employee identification and tax registration numbers under labor law
- Maintaining customer transaction records for tax and audit purposes (typically 5 years)
- Processing healthcare data under medical record retention requirements
- Collecting customer identity verification data for anti-money laundering (AML) compliance
- Reporting employee data to government agencies as mandated by law
Documentation requirement: You must be able to cite the specific law or regulation that mandates the processing. Vague references to "general compliance" are insufficient.
4. Vital Interests
The vital interests lawful basis applies when processing is necessary to protect the vital interests of a data subject or another person. This basis is narrowly construed and reserved for life-or-death or serious harm scenarios.
Examples:
- Processing emergency contact information during a workplace accident to alert family members
- Sharing a customer's medical allergies with emergency responders during a medical crisis
- Processing health data to prevent an imminent threat to life or physical safety
- Sharing location data with search and rescue teams during an emergency
Important note: Vital interests should be your last resort basis, used only when consent cannot be obtained and processing is genuinely necessary to protect someone from serious harm. This basis does not allow routine business processing.
5. Public Task (for Public Sector)
If your organisation needs to process personal data "for the performance of a task carried out in the public interest" or "in the exercise of official authority", you can do so using this lawful basis. This basis applies primarily to government entities and public bodies performing statutory functions.
Examples (government entities only):
- Ministry of Health processing patient data to deliver healthcare services
- General Authority for Zakat and Tax collecting taxpayer information
- Customs authority processing traveler data at borders
- Immigration processing national ID data for visa issuance
Private sector applicability: Private organizations cannot rely on the public task basis unless they are contracted to perform a specific public function on behalf of a government entity. Even then, the scope is strictly limited to that contracted function.
6. Legitimate Interests
Processing is necessary for the controller's legitimate interest, provided this doesn't prejudice the rights and interests of the data subject and doesn't involve sensitive data. The purpose can't breach Saudi law, it must fall within the data subject's reasonable expectations, and you must balance your interests against theirs.
Legitimate interest is the most flexible lawful basis but also the most scrutinized. It requires a formal assessment and careful documentation.
Examples of legitimate interests:
- Processing customer transaction history to detect and prevent fraud
- Maintaining employee performance records for promotion and development decisions
- Processing website visitor IP addresses and behavior logs for security monitoring and attack prevention
- Analyzing customer purchasing patterns to improve product offerings and inventory management
- Processing employee contact lists to enable internal communication and collaboration
- Sharing customer data with credit reference agencies to assess credit risk before granting credit
The three-part test for legitimate interest:
- Purpose test: Is there a genuine, identifiable business purpose? The purpose must be lawful under Saudi law and fall within what data subjects would reasonably expect.
- Necessity test: Is the processing truly necessary to achieve that purpose? Could you achieve the same purpose with less intrusive means?
- Balancing test: Do your interests outweigh the data subject's rights and interests? Consider the nature of the data, the individual's expectations, and potential harms.
You can use legitimate interest only when the processing is genuinely necessary for your operations and fair to the individual. It is not a blanket authorization for any business need.
Decision Tree: Identifying Your Lawful Basis
Use this decision tree to classify your processing activities:
Step 1: Is processing required by law?
- Yes → Use Legal Obligation as your lawful basis. Document the specific regulation or law.
- No → Go to Step 2
Step 2: Is processing necessary to perform a contract you have with the data subject?
- Yes → Use Contract Performance as your lawful basis.
- No → Go to Step 3
Step 3: Is the processing necessary to protect someone's vital interests (life or serious physical safety)?
- Yes → Use Vital Interests as your lawful basis (emergency scenarios only).
- No → Go to Step 4
Step 4: Are you a public entity performing a statutory public function?
- Yes → Use Public Task as your lawful basis (document the statute).
- No → Go to Step 5
Step 5: Does the processing serve a genuine business purpose, is it necessary to achieve that purpose, and do your interests not override the data subject's rights?
- Yes to all → You may use Legitimate Interest as your lawful basis (but avoid sensitive data and document your assessment).
- No to any → Go to Step 6
Step 6: None of the above apply?
- You must obtain Consent from the data subject before processing begins.
Practical Examples by Industry
E-Commerce
- Customer name, address, phone: Contract Performance (order fulfillment)
- Payment card details: Contract Performance (payment processing)
- Purchase history for product recommendations: Legitimate Interest (personalization and improved service)
- Email for promotional offers: Consent (unless soft opt-in exception applies)
- IP address for fraud detection: Legitimate Interest (security and fraud prevention)
- Tax ID for government reporting: Legal Obligation
Financial Services
- Customer identity and account details: Contract Performance + Legal Obligation (AML/KYC requirements)
- Credit score and financial history: Legitimate Interest (credit risk assessment) + Consent (if sharing with third parties)
- Transaction monitoring for AML: Legal Obligation
- Customer communication logs: Legitimate Interest (dispute resolution and audit trail) + Consent (if marketing-related)
Healthcare
- Patient medical records: Contract Performance (treatment delivery) + Vital Interests (emergency care)
- Health data for treatment: Consent (unless emergency overrides)
- Patient contact information for appointment reminders: Legitimate Interest (operational efficiency) or Consent (if unsolicited)
- Health data for research (anonymized): Legitimate Interest (medical advancement) or Consent (if identifiable)
- Medical records retention (7 years): Legal Obligation
Employment
- Employee name, ID, salary, bank account: Contract Performance (employment agreement) + Legal Obligation (payroll, tax)
- Performance reviews and promotion decisions: Legitimate Interest (HR management)
- Disciplinary records: Legitimate Interest (employment decisions) + Legal Obligation (some jurisdictions)
- Employee email and communications: Legitimate Interest (business operations, security monitoring) + Consent (for non-work monitoring)
- Occupational health and safety data: Legal Obligation (workplace safety regulations)
Common Pitfalls and How to Avoid Them
Pitfall 1: Conflating Legitimate Interest with Business Convenience
The problem: Organizations claim "legitimate interest" simply because they want to process data, without conducting a proper assessment. Example: "We process customer email addresses under legitimate interest for our newsletter" (when no prior interaction justifies this expectation).
The fix: Document the three-part test. Write down your purpose, explain why processing is necessary (not just convenient), and evidence that your interests don't override the data subject's rights. If you can't write it down convincingly, you likely need consent.
Pitfall 2: Using Contract Performance to Process Unrelated Data
The problem: Businesses justify processing data as "necessary for contract" even when it isn't. Example: Collecting employer name and work history when it's not required to fulfill the sale. This violates data minimization and misapplies the contractual lawful basis.
The fix: Ask: "Is this information strictly necessary to deliver what the customer ordered?" If the answer is no, you need a different lawful basis or you shouldn't collect it at all.
Pitfall 3: Overlooking Sensitive Data Restrictions
The problem: Organizations assume legitimate interest applies to sensitive data (health, genetic, biometric, religious, sexual orientation data). It doesn't. Legitimate interest cannot be used where sensitive data is involved.
The fix: If processing sensitive data, your lawful basis options are limited to: consent (usually explicit), legal obligation, vital interests (emergency), or public task (public sector). Document which basis applies.
Pitfall 4: Failing to Document the Lawful Basis
The problem: Organizations informally identify a lawful basis but don't record it. When SDAIA enforces, the controller cannot demonstrate what basis they relied on.
The fix: Document your lawful basis in your Record of Processing Activities (RoPA). For legitimate interest, conduct and retain a Legitimate Interest Assessment (LIA). For consent, maintain evidence (logs, timestamps, user acknowledgments).
Documenting Your Lawful Basis
Under PDPL, you must document the lawful basis for each processing activity. Your Record of Processing Activities (RoPA) should include:
- Name of the processing activity (e.g., "customer order fulfillment")
- The lawful basis relied upon (one of the six listed above)
- Description of the personal data processed
- Categories of data subjects affected
- Purpose of the processing
- For legitimate interest: summary of your Legitimate Interest Assessment, including your balancing test
- For consent: evidence that consent was obtained (and is revocable)
- For legal obligation: reference to the specific law or regulation
- Duration of storage and retention policy
Additionally, your privacy notice (required under PDPL) must inform data subjects of the lawful basis for processing. This transparency requirement means you cannot hide behind a vague lawful basis—you must communicate it clearly.
Interplay Between Lawful Bases and Other PDPL Obligations
Identifying a lawful basis is just the first step. You must also satisfy other PDPL obligations that run parallel to lawful basis requirements:
- Data Processing Agreements (DPA): If you use a processor, your DPA must specify the lawful basis for processing. See our guide on PDPL data processing agreements for details.
- Data Subject Rights: Regardless of your lawful basis, data subjects retain rights to access, correction, deletion, and portability (with limited exceptions). Learn more in our post on data subject rights under PDPL.
- Regulatory Scope: Confirm that your organization is subject to PDPL. Even if you are, your lawful basis must be identified. See whether your business is subject to PDPL.
- Registration and Compliance: Some organizations must register with SDAIA. Your lawful basis should be documented in your registration. Review PDPL data controller registration requirements.
SDAIA Enforcement and Lawful Basis Violations
SDAIA has made clear through enforcement decisions that misapplying or failing to document a lawful basis is a serious violation. Organizations that cannot demonstrate a proper lawful basis face substantial fines and reputational damage. Fines can reach SAR 5M, with criminal penalties for unlawful handling of sensitive data.
Common enforcement themes include:
- Processing without any documented lawful basis
- Claiming legitimate interest without a proper assessment
- Using contract performance to justify unrelated data collection
- Processing sensitive data on weak legal grounds
- Failing to provide data subjects with transparent notice of the lawful basis
For insight into real enforcement cases, read our analysis of SDAIA PDPL enforcement cases from 2025-2026.
Frequently Asked Questions
Can we process data under "legitimate interest" without any assessment?
No. Legitimate interest requires documented justification via a Legitimate Interest Assessment (LIA). The LIA must address the three-part test: purpose, necessity, and balancing. SDAIA expects to see this assessment in your compliance records. Without it, you cannot credibly claim legitimate interest, and your processing is considered unlawful.
If we have multiple lawful bases for one processing activity, which one should we document?
Document all applicable lawful bases. For example, processing employee salary data is justified by both Contract Performance (the employment agreement) and Legal Obligation (tax and labor law requirements). List all applicable bases in your RoPA. This demonstrates thorough compliance and provides multiple independent grounds if one is challenged.
Does "legitimate interest" allow us to use customer data for direct marketing?
Legitimate interest alone is insufficient for unsolicited direct marketing (especially electronic communications like email or SMS). You generally need explicit consent for direct marketing. However, if a customer has an existing relationship with you (e.g., a previous purchase), a limited "soft opt-in" may apply under PDPL in some cases, subject to opt-out rights. Consult your legal team on the scope of this exception in your context.
Can we rely on "vital interests" to justify processing health data in a non-emergency?
No. Vital interests apply only to genuine emergencies where someone's life or serious physical safety is at risk. Routine healthcare operations (e.g., storing medical records for ongoing treatment) should rely on Contract Performance or, if applicable, Legal Obligation. Do not stretch vital interests beyond its narrow scope.
What happens if we misidentify the lawful basis and SDAIA discovers it?
SDAIA may issue a compliance order requiring you to stop the processing or obtain consent retroactively (which often fails). You may face fines under the PDPL penalty framework. Your privacy notice may be deemed misleading if it misstates the lawful basis. The best remedy is to audit your processing activities now, identify any misclassifications, and correct them before enforcement.
Conclusion
Mastering PDPL lawful bases is fundamental to compliance. Consent is the default, but the law recognizes five additional bases—contract performance, legal obligation, vital interests, public task, and legitimate interest—that allow processing without consent in the right circumstances. Each basis has specific requirements and limitations. Legitimate interest, while flexible, demands rigorous assessment and documentation. Failing to properly identify and document your lawful basis is among the most common violations SDAIA has encountered.
The path forward is clear: conduct a comprehensive inventory of all processing activities, assign a lawful basis to each with supporting documentation, and ensure your privacy notices transparently communicate these bases to data subjects. Start this audit today—the compliance grace period has passed, and enforcement is now the reality.