In this article
- What the PDPL changes for a sales team
- Consent is the rule that catches CRM users most often
- The five rights your customers can exercise
- A PDPL compliance checklist for your CRM
- Where the data lives, and who else can see it
- What it costs to get this wrong
- A tidy CRM makes most of this ordinary
- Frequently asked questions
Sales teams collect phone numbers, email addresses and notes about people every working day, and almost all of it ends up in the CRM. That makes PDPL CRM Saudi Arabia compliance a sales and operations problem, not only a legal one. The Personal Data Protection Law has been fully enforceable since 14 September 2024, and the Saudi Data and AI Authority, SDAIA, oversees it.
The useful news is that most of its obligations are practical. It asks you to know what customer data you hold, why you hold it, who else sees it, and to act when a customer asks you to stop. This guide covers the parts that touch a CRM directly, with the article numbers so you can check each point yourself.
What the PDPL changes for a sales team
The law covers any processing of personal data relating to individuals in the Kingdom, and Article 1 defines processing very broadly: collecting, recording, storing, organising, using, disclosing, transferring, publishing, sharing, linking, blocking, erasing and destroying. Typing a lead's mobile number into a deal record is processing. So is exporting a list, or sending it to an agency.
Two roles decide who carries the duty. You are the controller when you decide why and how customer data is used. A supplier that processes data on your instructions, such as a hosting provider, is a processor. The obligations sit with the controller, so a vendor contract alone does not move the responsibility off your desk.
Article 12 requires a privacy policy, made available to people before you collect their data. It has to state the purpose of collection, the data you collect, the means used for collection, processing, storage and destruction, and people's rights and how to exercise them. If your website enquiry form has no privacy notice beside it, close that gap first.
Consent is the rule that catches CRM users most often
Article 5 sets the default. Personal data may not be processed, and the purpose of processing may not be changed, without the consent of the data subject, and that consent may be withdrawn at any time. Article 7 adds that consent may not be made a condition of providing a service, unless the service is directly related to the processing you are asking about.
Article 6 lists the cases where consent is not needed. These include processing under another law or to perform an agreement to which the person is a party, and processing necessary for the legitimate interest of the controller, provided no sensitive data is involved. Serving a customer under a signed contract usually sits inside those exceptions. A cold list does not.
Marketing carries its own rule, and it is the one most often broken. Under Article 25 you may not use a person's personal means of communication, including post and email, to send advertising material unless you have the prior consent of the targeted recipient and you provide a clear mechanism that lets them ask you to stop. Article 26 permits processing for marketing purposes only where the data was collected directly from the person and their consent was given, and never for sensitive data.
For your pipeline that means a purchased list is a problem, a scraped list is a problem, and an unsubscribe route is part of what makes the sending lawful.
The five rights your customers can exercise
Article 4 gives every data subject five rights, and Article 21 requires the controller to respond within the period set out in the Implementing Regulations. Each needs a named owner and a route into the CRM, otherwise requests arrive by email and quietly expire in someone's inbox.
| Right under Article 4 | What it looks like in your CRM |
|---|---|
| To be informed of the legal basis and purpose of collection | A privacy notice on every form, and a recorded source on every contact |
| To access their personal data held by you | Someone can pull everything held about one contact, notes and calls included |
| To obtain their data in a readable, clear format | A per contact export you can produce without a developer |
| To have data corrected, completed or updated | Edit rights and an audit trail, so the change is traceable |
| To request destruction when the data is no longer needed | A documented delete path, not an "inactive" flag |
Article 34 lets a person take a complaint straight to SDAIA. A customer who asks twice to be removed and hears nothing has an easy next move, so treat these requests like service tickets with a clock on them.
A PDPL compliance checklist for your CRM
Most of the work is inventory and habit rather than technology. Walk your system against this list and write down what you find, because the gaps are usually in old data and informal exports, not in the software.
- List every place customer data enters: web forms, trade shows, incoming enquiries, spreadsheets, business cards typed in by hand.
- Record the source and consent status on each contact, so anyone can see why that person is in the system.
- Put a privacy notice next to every form, and link the full policy from it.
- Separate marketing consent from service communication, and keep the date it was given.
- Add an unsubscribe route to every campaign, and make sure it writes back to the CRM.
- Restrict who can export and review the log, because loose copies are what leak.
- Set a retention period for untouched leads, and destroy them when it passes.
- Name an owner for data subject requests and breach reporting.
The retention point deserves emphasis. Article 11 requires the controller to cease collection and destroy previously collected data, without undue delay, once it is no longer necessary for the purpose it was collected for. A CRM full of leads nobody has touched in years is not a dormant asset, it is a liability.
Where the data lives, and who else can see it
Article 31 requires records of processing activities, available whenever the authority requests them. The minimum contents are your contact details, the purpose of the processing, the categories of data subjects, any other entity the data is disclosed to, whether it is transferred outside the Kingdom, and the expected retention period. For most SMEs that is one maintained document, not a project.
Transfers abroad are governed by Article 29. They are permitted for defined purposes, including performing an obligation to which the data subject is a party, and subject to conditions: no prejudice to national security or the vital interests of the Kingdom, an adequate level of protection outside the Kingdom, and the minimum data needed. If your CRM, email tool or backup sits on servers abroad, that is a transfer, and it belongs in your Article 31 record.
Two further duties sit alongside it. Article 22 requires an impact assessment of processing in relation to any product or service, based on the nature of your activity. Article 20 requires you to notify the authority once you know of any breach, damage or illegal access to personal data, and to notify the affected person where the incident would harm their data or prejudice their rights.
What it costs to get this wrong
Article 36 covers general violations. A warning or a fine not exceeding five million Riyals may be imposed on any person covered by the law who breaches it or the regulations, and the fine may be doubled for a repeat violation. A committee formed by the authority examines violations and issues the warning or the fine, taking into account the type of violation, its seriousness and its impact. Decisions may be appealed before the competent court.
Article 35 is narrower and heavier. Anyone who discloses or publishes sensitive data in violation of the law, intending to harm the data subject or gain a personal benefit, faces imprisonment of up to two years, or a fine of up to three million Riyals, or both, and the court may double the fine in the case of recidivism.
Keep that in proportion: the committee weighs seriousness and impact, so a documented system is treated differently from an absent one.
A tidy CRM makes most of this ordinary
Nearly every obligation here comes back to one question: can you find everything you hold about a person, and show why you hold it? That is far easier when sales, quotations and support read from one customer record instead of four spreadsheets.
The Daftarix CRM for Saudi businesses keeps leads and contacts in a searchable list with the full history on each record, moves deals through a visual pipeline with stage values, and logs calls, meetings and notes with the next step against the contact. Quotations are created from the deal with customer details filled in, team view shows who owns which deal, and the interface works in Arabic and English. Because a won deal carries through to a quotation and then an invoice without re-entry, there are fewer stray copies to govern. Still choosing? Our guide on how to choose the best CRM in Saudi Arabia covers the criteria.
Book a demo and we will walk through how your customer records, consent status and follow ups would sit in one place.
Frequently asked questions
Does the PDPL apply to a small business with a few hundred contacts?
Yes. The law turns on processing personal data about individuals in the Kingdom, not on company size or record count. Article 2 excludes processing for purposes that do not go beyond personal or family use, which does not cover a commercial CRM.
Can we email our existing customers about a new product?
Article 25 requires prior consent of the targeted recipient before advertising material is sent to their personal means of communication, together with a clear mechanism to stop receiving it. Service messages about something a customer already bought differ from promoting a new product, so record marketing consent separately and rely on it.
Is a tick box on our web form enough consent?
It can be part of it, if it is specific about what the person is agreeing to and is not bundled with access to the service, as Article 7 requires. Keep the wording they saw and the date. The Implementing Regulations set the conditions of consent and when it must be explicit.
What do we do first if we have done none of this?
Write the inventory: where customer data comes from, where it sits, who it goes to and how long you keep it. That one document answers most of Article 31, shows which forms need a privacy notice, and tells you which records to destroy under Article 11.
Where can we read the law itself?
SDAIA publishes the full text and handles complaints and enforcement. See the Personal Data Protection Law and the SDAIA website for the current regulations.
