Every contact form, WhatsApp button and newsletter box on your website collects personal data. In Saudi Arabia that data is governed by the Personal Data Protection Law (PDPL), which has been fully enforceable since September 2024. Most small business sites are not doing anything wrong on purpose; they simply have forms nobody reviewed and a privacy page copied from somewhere else. This PDPL website compliance checklist turns the law into concrete tasks for a WordPress site.
In short:
- The PDPL came into force on 14 September 2023, and the grace period for compliance ended on 14 September 2024.
- Your website needs a clear privacy notice, a defined purpose for every form, and prior consent before marketing messages.
- Personal data breaches must be reported to the regulator within 72 hours; requests from individuals should be answered within 30 days.
- Serious violations can bring fines of up to SAR 5 million. This article is general guidance, not legal advice.
In this checklist
What PDPL website compliance means for a business
The Personal Data Protection Law is supervised by the Saudi Data & AI Authority (SDAIA). It applies to any processing of personal data relating to individuals in the Kingdom, including processing by entities outside it. For a website, personal data means anything that identifies a person: a name, phone number, email address, national ID, IP address, or a message that describes their situation.
The law came into force on 14 September 2023, and organisations were given a year to adjust. Since 14 September 2024 its requirements are fully enforceable. If your website has a form, a booking system, a newsletter, a careers page or an online store, it is in scope.
Lawful purpose
Collect data only for a clear, stated purpose and use it for that purpose.
Minimum data
Ask only for what you need to deliver the service.
Transparency
Tell people what you collect, why, and how long you keep it.
Security
Protect the data and report breaches quickly.
Step 1: Map the personal data your website collects
You cannot write an honest privacy notice until you know what the site actually collects. Spend half an hour listing every entry point:
- Contact, quote and booking forms, and where submissions go (email, database, CRM).
- Job application forms and CV uploads, which often contain sensitive details.
- Newsletter or offer sign-ups.
- WooCommerce orders and customer accounts.
- Analytics and advertising tags that set cookies or record IP addresses.
- Plugins that store form entries, logs or user activity in the database.
For each one, note what fields are collected, why, who can see them, and how long they are kept. This table becomes the basis of your privacy notice and your answer to any data request.
Step 2: Publish a privacy notice people can understand
A privacy notice copied from another company is worse than useless; it describes processing you don't do and omits what you do. Write one that matches your data map, in Arabic and in English if your site is bilingual. It should cover:
- Who you are and how to contact you about personal data.
- What data you collect and through which forms or tools.
- The purpose of each type of collection and its legal basis.
- Who you share data with, such as hosting, email or payment providers.
- How long you keep data before deleting it.
- The rights of individuals and how to exercise them.
- Whether data is transferred outside Saudi Arabia.
Link to the notice in the footer of every page and next to every form.
Step 3: Fix your WordPress forms
Forms are where most websites collect data, so they are where compliance becomes visible.
Remove fields you don't need
If you only call people back, you don't need their date of birth or ID number.
State the purpose next to the button
A short line such as "We use these details only to reply to your request" with a link to the privacy notice.
Separate marketing consent
An unticked checkbox for offers and newsletters. Marketing requires prior consent, and it cannot be a condition of getting a reply.
Limit stored entries
If your form plugin stores submissions, set a retention period and delete old entries.
Protect uploads
CV and document uploads should not sit in a publicly accessible folder.
Every WordPress form plugin can do this; the work is in deciding what is necessary and writing it clearly.
Step 4: Cookies and tracking tags
The PDPL does not set out a dedicated cookie rule in the way some other regimes do. But cookies and tracking tags that identify visitors still involve personal data, so the general principles apply: be transparent about them, use them for a stated purpose, and collect no more than you need.
In practice, that means listing your analytics and advertising tools in the privacy notice, removing tags you no longer use, and considering a simple consent banner if you run advertising or remarketing pixels. Fewer scripts also make your site faster, which helps conversions; see why website speed drives sales.
Step 5: Secure the WordPress site itself
The law requires appropriate measures to protect personal data. For a WordPress website, the basics carry most of the weight:
- HTTPS on every page, with no mixed-content warnings.
- WordPress core, theme and plugins kept up to date; unused plugins deleted.
- Strong passwords and two-factor authentication for every administrator.
- Only the user accounts you need, with the lowest role that does the job.
- Automatic off-site backups, tested by actually restoring one.
- A firewall or security plugin that limits login attempts and logs changes.
None of this is exotic, but on many small business sites at least two of these are missing.
Step 6: Prepare for breaches and data requests
Two time limits matter. If a personal data breach occurs, the controller must notify SDAIA within 72 hours of becoming aware of it, and inform affected individuals where the breach could harm them. And when someone asks to access, correct or delete their data, you should respond within 30 days.
Neither deadline is realistic if you start from zero when the problem arrives. Write a one-page plan now:
- Who is responsible for personal data in your business.
- Who to call if the website is hacked: developer, host, and who notifies the regulator.
- Where form entries and customer data are stored, so they can be found, exported or deleted.
- A template reply for data requests in Arabic and English.
Step 7: Check plugins, processors and data transfers
A WordPress site rarely processes data alone. Your host stores the database, an email service delivers form notifications, a payment gateway handles orders, and plugins may send data to their own servers. Each of these is processing personal data on your behalf, and you remain responsible for choosing them carefully.
- List each service that receives personal data from the site, and what it receives.
- Prefer providers that publish clear data protection terms and security practices.
- Check which plugins phone home with visitor data, and remove those you don't need.
- Note where each provider stores data. The PDPL places conditions on transferring personal data outside the Kingdom, so record transfers and their justification.
This review also tends to improve performance and security, because every plugin you remove is one less thing to update and one less script to load.
Keeping PDPL website compliance up to date
Compliance is not a one-time project. Websites change: a new landing page adds a form, a marketing agency installs a pixel, a plugin update starts storing entries. Build a short review into your routine:
- Every quarter, compare the forms and tags on the live site with your data map.
- Whenever you add a plugin or tool, ask what personal data it touches before installing it.
- Once a year, reread your privacy notice and update the date and any changes.
- After any security incident, update the breach plan with what you learned.
SDAIA also publishes implementing regulations and guidance that refine how the law applies, so check the official platform periodically for updates.
The complete PDPL website compliance checklist
| Area | Task | Done? |
|---|---|---|
| Data map | Every form, plugin and tag listed with purpose and retention | ☐ |
| Privacy notice | Written for your site, linked in footer and beside forms | ☐ |
| Forms | Only necessary fields; purpose stated | ☐ |
| Marketing | Separate, unticked consent checkbox | ☐ |
| Retention | Old form entries deleted on a schedule | ☐ |
| Cookies | Tools disclosed; unused tags removed | ☐ |
| Security | HTTPS, updates, 2FA, backups | ☐ |
| Breach plan | 72-hour notification process documented | ☐ |
| Requests | 30-day response process and templates ready | ☐ |
Building compliant WordPress websites with Webnaa
When Webnaa builds a WordPress website, the forms, consent checkboxes, privacy page structure, HTTPS and backups are part of the build rather than an afterthought. We don't replace your legal adviser, but we make sure the website does what your privacy notice says it does.
Planning a new WordPress website?
Webnaa offers websites from SAR 39 a month on one subscription that includes hosting and technical support, paid every 6 months or yearly with 10% off and no setup fee, with a domain in your name on every custom-domain website; price yours in our price calculator.
Choose what you need, see your exact price
The price updates with every choice. No surprises, no hidden fees.
The calculator is off. Press the power button to start
From Zoho, a global provider with data centres in Riyadh and Jeddah. More than 10 addresses are quoted separately.
Privacy is one part of the picture. For the business details, store authentication, VAT and legal pages a Saudi website needs, see Saudi website legal requirements.
FAQ
Does the PDPL apply to small business websites?
Yes. If your website collects personal data from people in Saudi Arabia — even just a name and phone number in a contact form — the law applies.
Do I need a cookie banner under the PDPL?
The PDPL has no dedicated cookie rule, but cookies that identify visitors involve personal data. Disclose them in your privacy notice, and consider a consent banner if you use advertising or remarketing tags.
How quickly must a data breach be reported?
The controller must notify SDAIA within 72 hours of becoming aware of a personal data breach.
What are the penalties for violating the PDPL?
Violations can lead to warnings and fines of up to SAR 5 million, which can be doubled for repeat violations. Unlawful disclosure of sensitive data can also carry criminal penalties.
Can I send marketing messages to people who filled in my contact form?
Only if they gave prior consent to marketing. Use a separate, unticked checkbox for offers and newsletters.
Summary
PDPL website compliance is mostly about doing ordinary things deliberately: know what your WordPress site collects, explain it honestly, collect less, ask before marketing, keep the site secure, and have a plan for breaches and requests. A few hours of work closes most of the gaps on a typical business website. For anything specific to your sector or data, speak to a qualified legal adviser.
Source: SDAIA – National Data Governance Platform. This article is general information, not legal advice.