PDPL: patient data, consent and where it lives

The Personal Data Protection Law in Saudi Arabia, overseen by SDAIA, applies to any clinic that processes patient data, and health data is a sensitive category with stricter rules. The grace period ended on 14 September 2024. Enforcement decisions published in 2025 and 2026 include sending marketing communications without consent, and the law sets fines per violation. For a clinic the practical questions are where the data is hosted, who consented to what, how long records are kept, and who can see the trail. The UAE has a federal data protection law and a health-data law of a similar shape; this page follows the Saudi text.

What it requires

• A lawful basis and, for health data, explicit consent recorded before processing, with the purpose stated in plain language
• No marketing or promotional messages to a patient who has not opted in, and an opt-out that works
• Data kept in the country unless a transfer meets the law's conditions, and a transfer risk assessment where it does not
• Retention limited to the purpose, then deletion or anonymisation
• A record of processing, a breach notification process and a named person responsible
• Patients can ask what you hold, correct it and have it deleted where the law allows

What the system provides

• Hosting in the jurisdiction health data must stay in, with backups and monitoring under the maintenance plan
• A consent line before the first WhatsApp reminder, stored per patient with its time and wording, and an opt-out the assistant honours
• Reminders and receipts only; no promotional message unless the patient opted in separately
• An audit trail on every record change and every assistant reply, readable from the admin
• De-identification before any text reaches a language model, and a human hand-off in every assistant

What we do not claim yet

• We do not register your clinic with the regulator, appoint your data protection officer or write your privacy notice; we provide the technical controls and the trail
• No SDAIA accreditation or certification is claimed

Sources

• Kiteworks: PDPL compliance and healthcare data protection

These pages are engineering notes, not legal advice. Confirm your obligations with the regulator or a licensed adviser before you rely on them.