UAE and Saudi data laws: what they mean for loyalty data
Key takeaways
- Saudi Arabia's PDPL has been fully enforceable since 14 September 2024, and consent is its primary legal basis, so loyalty programmes in the Kingdom no longer have a grace period.
- The UAE's Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022, but the sources reviewed do not verify the Executive Regulations or a published penalty schedule.
- SDAIA's committees reportedly issued 48 decisions in 2025, including cases of marketing messages sent without consent, but no source names a loyalty operator or retailer that was fined.
Saudi Arabia's Personal Data Protection Law has been fully enforceable since 14 September 2024, according to PwC's 2024 guidance. The UAE's Federal Decree-Law No. 45 of 2021 has applied since 2 January 2022, but no source reviewed confirms a published fine schedule or a fine against a loyalty operator.
Loyalty data is personal data. Clifford Chance's 2025 commentary notes that the regimes in both countries define personal data broadly, as any information relating to an identified or identifiable person, such as customer data. For programme teams, this means a member record with contact details and purchase history sits inside the wording of both laws.
This analysis covers consent, penalties, cross-border transfers and the evidence on enforcement. It separates what the laws and guidance say from what is not published. Several points are not verified in the sources reviewed, including the UAE Executive Regulations, any named company's compliance change and any consultancy estimate of what data sovereignty costs a loyalty programme.
Key figures
- 14 September 2024 Date the Saudi PDPL became fully enforceable after a one-year grace period (PwC, 2024) (pwc.com)
- SAR 5,000,000 Maximum fine for breach of the Saudi PDPL, which a court may double for repeat violations (PwC, 2024) (pwc.com)
- 2 January 2022 Effective date of UAE Federal Decree-Law No. 45 of 2021, listed as Active (UAE Legislation portal) (uaelegislation.gov.ae)
- 48 Decisions reportedly issued by SDAIA's committees during 2025, announced in January 2026 (iapp.org)
- Five years Period UAE licensed financial institutions must keep a copy of marketing consent after the customer relationship ends (UAE Central Bank Consumer Protection Standards) (rulebook.centralbank.ae)
MELA's view
For programme teams, the Saudi position is the clearer of the two: the grace period has ended, consent is the headline basis, and marketing without consent is a reported enforcement category.
In the UAE, the law is in force but the penalty schedule and Executive Regulations could not be verified, so waiting for clarity is a weak plan. Building to the stated consent standard now, with provable, withdrawable and purpose-specific opt-ins, is the safer course.
Loyalty programmes differ from ordinary marketing because member data often moves between partners, cloud platforms and overseas teams. Each of those moves can be a transfer under Saudi rules, and bank partners may add UAE or Saudi localisation duties.
The lack of public enforcement names and of consultancy cost studies means internal evidence matters more. A clean data map and consent record is the best defence and the best basis for a cost case.
Questions and answers
When did the Saudi PDPL become enforceable?
The PDPL came into force on 14 September 2023, according to SDAIA. PwC's 2024 guidance says it became fully enforceable from 14 September 2024, after a one-year grace period in which SDAIA said no penalties would be applied.
What is the maximum fine under the Saudi PDPL?
PwC's 2024 guidance says fines can reach SAR 5,000,000, and a court may double the fine for repeat violations. It also cites up to two years' imprisonment for disclosing sensitive data in breach of the law with intent to harm or for personal gain. Clyde & Co's 2021 summary lists a separate SAR 3 million tier for sensitive data disclosure.
Does the UAE personal data law set specific fines?
No. An overview hosted by the Australian National University says the law does not explicitly state penalties. Article 26 leaves it to the Council of Ministers to specify violations and administrative penalties by decision, and the sources reviewed do not verify a published decision.
Can a loyalty programme store member data with an overseas cloud provider?
Under the Saudi PDPL, SDAIA's guide treats cloud storage abroad as a transfer that must meet the law's conditions, including data minimisation and an approved safeguard or mechanism. The UAE federal law allows transfers to adequate jurisdictions or under listed grounds, according to the UAE Legislation text. Clifford Chance's 2025 commentary says sector rules, such as the UAE Central Bank's, may require local storage for banks.
Has SDAIA fined any loyalty programme or retailer?
No source verifies this. SDAIA's committees reportedly issued 48 decisions during 2025, including cases of marketing messages sent without consent, but the January 2026 announcement named no organisations and gave no fine amounts.
Do UAE banks need consent before using data for direct marketing?
Yes. The UAE Central Bank's Consumer Protection Standards require informed, expressed consent for direct marketing. Banks must keep a copy of that consent for five years after the customer relationship ends and allow withdrawal for marketing-related sharing.
Have the UAE Executive Regulations been issued?
The sources reviewed could not verify it. DataGuidance reported in October 2024 and DLA Piper said as of 6 January 2025 that they had not been published, and the UAE Government portal does not state whether they have been issued since.
