Cross-Border Data Transfers: Building One Governance Framework Across GDPR and KSA PDPL

For multinational organisations, personal data rarely remains within one jurisdiction.

A European headquarters may rely on teams or service providers in Saudi Arabia. A Saudi entity may use centralised HR, finance, customer-management or cloud systems located elsewhere. Group companies, vendors, professional advisers and technical-support teams may access the same datasets from several countries as part of a single business process.

This creates an increasingly important compliance question:

Can one global international data-transfer framework work across both the GDPR and Saudi Arabia’s Personal Data Protection Law?

To a significant extent, yes.

Both regimes seek to ensure that personal data does not lose protection simply because it crosses a border. Both recognise mechanisms relating to adequacy, contractual safeguards and intra-group transfers. Both may also require organisations to assess and document the circumstances and risks surrounding a transfer.

But similar concepts do not mean identical legal requirements.

The GDPR and KSA PDPL operate through different legal architectures, regulatory mechanisms and transfer conditions.

For multinational organisations, the objective should therefore not be to create a completely separate transfer programme for every jurisdiction.

A more scalable approach is to build one global transfer-governance framework, with the relevant jurisdiction-specific legal requirements built into it.

When can both the GDPR and KSA PDPL apply?

Before considering the transfer mechanism, organisations first need to understand which data-protection framework applies to the underlying processing activity.

Under Article 3 GDPR, the Regulation applies to processing carried out in the context of the activities of an establishment in the EU, regardless of where the processing itself takes place.

It can also apply to organisations established outside the EU where their processing relates to:

• offering goods or services to individuals in the EU; or
• monitoring their behaviour within the EU.

Saudi Arabia’s PDPL also has extraterritorial reach.

Article 2 applies to the processing of personal data relating to individuals that takes place in the Kingdom and also extends to processing by entities outside the Kingdom where that processing concerns individuals residing in Saudi Arabia.

This means that the location of an organisation’s headquarters does not, by itself, determine which privacy framework applies.

Consider a multinational organisation operating a common cloud-based HR platform for employees in Europe and Saudi Arabia, with centralised support provided from another country.

The organisation may need to analyse European-originating transfers under the GDPR while separately assessing Saudi-originating data flows under Article 29 PDPL and the Regulation on Personal Data Transfer Outside the Kingdom.

The technology may be shared.

The vendor may be the same.

The underlying business process may be centralised.

The applicable transfer analysis may nevertheless be different.

A common objective: protection should travel with the data

At a high level, the GDPR and KSA PDPL address the same policy concern.

International transfers should not undermine the protection afforded to personal data simply because that data moves to another jurisdiction.

Under Article 44 GDPR, transfers to third countries or international organisations must comply with the conditions laid down in Chapter V.

The GDPR therefore establishes a series of transfer routes, principally including:

• adequacy decisions;
• appropriate safeguards; and
• derogations for specific situations.

Saudi Arabia approaches international transfers through Article 29 PDPL together with a dedicated Transfer Regulation.

Article 29 permits transfers outside the Kingdom for specified purposes, subject to conditions including that the transfer:

• does not prejudice the Kingdom’s national security or vital interests;
• provides an appropriate level of protection for personal data outside the Kingdom; and
• is limited to the minimum amount of personal data required for the relevant purpose.

The Transfer Regulation then provides further detail on matters including permitted transfer circumstances, adequacy, exemptions from certain conditions, appropriate safeguards, onward transfers and risk assessments.

The GDPR transfer architecture

Under the GDPR, an organisation will generally first consider whether the destination benefits from an adequacy decision under Article 45.

Where the European Commission has determined that a country, territory, specified sector or international organisation ensures an adequate level of protection, personal data may be transferred on that basis without an additional Article 46 safeguard.

Where adequacy is not available, organisations may consider the appropriate safeguards under Article 46.

These include mechanisms such as:

• Standard Contractual Clauses;
• Binding Corporate Rules;
• approved codes of conduct accompanied by binding commitments; and
• approved certification mechanisms accompanied by binding commitments.

The European Commission’s 2021 Standard Contractual Clauses use four role-based modules:

1. Controller → Controller
2. Controller → Processor
3. Processor → Processor
4. Processor → Controller

This modular approach allows organisations to select the contractual framework corresponding to the respective roles of the exporter and importer.

However, signing SCCs does not complete the GDPR transfer analysis.

Following the CJEU’s Schrems II judgment, and as reflected in Clause 14 of the 2021 SCCs, organisations relying on Article 46 safeguards must consider whether the laws and practices applicable in the destination country could undermine the effectiveness of those safeguards.

Where the transfer tool alone does not provide sufficient protection, supplementary contractual, technical or organisational measures may be required.

A GDPR transfer programme cannot be reduced to signing SCCs and filing them away.

Organisations need to understand their transfers, identify the appropriate mechanism, assess the relevant destination-country environment where required, implement supplementary measures where necessary and reassess the position when material circumstances change.

The KSA transfer architecture

Saudi Arabia has developed a transfer framework that uses some concepts familiar from European law but applies them through a distinctly Saudi regulatory structure.

Article 29 PDPL identifies the purposes and conditions governing transfers outside the Kingdom.

The Transfer Regulation then provides the more detailed operational framework.

Among other matters, it addresses:

• the circumstances in which transfers may occur;
• assessment of the level of protection in the destination;
• specific exemptions from certain Article 29 conditions;
• the safeguards that may support those exemptions;
• subsequent transfers; and
• circumstances requiring a transfer risk assessment.

Adequacy under the KSA framework

Article 3 of the Transfer Regulation establishes a Saudi mechanism for recognising jurisdictions or international organisations that provide an appropriate level of protection.

SDAIA is required to publish on its official website a list of countries or international organisations considered to provide a level of personal data protection that is not less than that required under the Saudi framework.

The assessment may take into account matters including:

• the existence of data-protection legislation and enforceable rights;
• an effective supervisory authority;
• the ability of regulators to cooperate with SDAIA;
• rules governing disclosure of personal data;
• international commitments; and
• safeguards concerning subsequent transfers.

A particularly interesting feature of the Saudi framework is that the relevant assessment criteria may also be applied to cities, special economic zones and global trade centres, rather than only to countries and international organisations.

There is, however, an important practical distinction between the Saudi and EU adequacy regimes.

The European Commission currently maintains an established list of adequacy decisions that organisations can use in practice.

At the time of the original publication, a corresponding public list of countries or international organisations recognised by SDAIA under Article 3 could not be identified in SDAIA’s published public materials.

This means that organisations should distinguish between:

• the legal existence of the Saudi adequacy mechanism; and
• the present practical availability of an adequacy determination for the particular destination concerned.

Organisations should therefore verify SDAIA’s latest position before relying on adequacy as the basis for a Saudi-originating transfer.

This is also relevant to transfer-governance records. A transfer register should not merely state that “adequacy” exists as a mechanism under the law. It should identify whether an adequacy determination is actually available for the destination concerned.

Appropriate safeguards under the Transfer Regulation

The Saudi framework should not be simplified into the proposition that, where adequacy is unavailable, an organisation may automatically use SCCs.

Article 4 of the Transfer Regulation applies in specified circumstances and provides exemptions from particular Article 29 requirements where the relevant conditions are satisfied and appropriate safeguards are implemented.

Those safeguards include:

• Standard Contractual Clauses;
• Binding Common Rules; and
• Certificate of accreditation.

The mechanism available depends on the circumstances and purpose of the particular transfer.

For example, the framework addresses specific scenarios including:

• certain transfers required for central operations within multinational groups;
• limited or non-recurring transfers;
• transfers necessary to provide a service or benefit directly to the data subject;
• scientific research and studies; and
• specified transfers involving public entities.

This makes proper classification of the transfer particularly important under the KSA framework.

An organisation needs to identify not only where personal data is going, but also:

• why it is being transferred;
• which provision of Article 29 and the Transfer Regulation applies;
• whether the general conditions are satisfied;
• whether an Article 4 exemption is relevant;
• which safeguard is available for that particular scenario; and
• whether additional requirements, including a risk assessment, are triggered.

EU and Saudi SCCs: familiar structure, different legal instruments

One of the clearest points of convergence between the EU and Saudi frameworks is the use of Standard Contractual Clauses.

SDAIA has issued four role-based SCC templates.

The similarity is operationally useful.

Multinational organisations already accustomed to identifying the roles of exporter and importer under the GDPR will recognise the same need to classify the relationship before selecting the relevant Saudi template.

But the legal instruments are not interchangeable.

The European SCCs operate under Article 46 GDPR and Commission Implementing Decision (EU) 2021/914.

The Saudi SCCs operate under the KSA PDPL and the Transfer Regulation and constitute one of the appropriate safeguards recognised by the Saudi framework.

Accordingly:

EU SCCs do not automatically satisfy a Saudi PDPL transfer requirement.

Equally:

Saudi SCCs are not a substitute for the transfer mechanism required under Chapter V GDPR.

For multinational organisations, this has a direct contracting consequence.

A single global data-processing agreement may need jurisdiction-specific transfer schedules or modules, rather than one universal set of international transfer clauses.

EU and Saudi SCCs compared

ELEMENT	EU GDPR	KSA PDPL
Legal basis	Article 46 GDPR and Commission Implementing Decision (EU) 2021/914	KSA PDPL and the Transfer Regulation
Structure	Four role-based modules	Four role-based SCC templates
Purpose	Appropriate safeguard for qualifying Chapter V transfers	Appropriate safeguard within the Saudi transfer framework where the applicable conditions are satisfied
Interchangeable?	No	No

Transfer risk assessments: convergence, but not equivalence

The two frameworks also share another important feature:

Contractual safeguards may need to be accompanied by an assessment of the real-world circumstances surrounding the transfer.

Under the GDPR, the Schrems II framework, Clause 14 of the SCCs and EDPB guidance require organisations to consider whether the laws and practices of the destination country could undermine the protection provided by the transfer mechanism.

Where necessary, supplementary measures must be considered.

Saudi Arabia has its own express transfer-risk-assessment requirement.

Article 7 of the Transfer Regulation requires a risk assessment before transfers made under the Article 4 safeguard framework.

A risk assessment is also required where sensitive personal data is transferred outside the Kingdom on a continuous or widespread basis.

The assessment must consider matters including:

• the purpose and legal basis for the transfer;
• the nature of the transfer;
• its geographical scope;
• the safeguards applied;
• data-minimisation measures;
• the possible material or moral effects on data subjects; and
• measures intended to prevent or mitigate the relevant risks.

SDAIA further developed this area through its Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom, issued in February 2025.

The Guideline provides a structured methodology for conducting transfer assessments, although SDAIA expressly identifies the document as guidance rather than a legally binding instrument.

What differs is:

• the legal source of the assessment obligation;
• the circumstances in which it is triggered;
• the factors that must be assessed; and
• the regulatory structure within which the assessment operates.

Where the frameworks converge and where they differ

The two regimes show significant convergence in international-transfer governance, but they should not be treated as equivalent.

The similarities mean multinational organisations can reuse significant parts of their international privacy-governance infrastructure.

The differences mean they cannot simply describe an EU transfer procedure as “global” and assume it satisfies Saudi law.

GDPR and KSA PDPL transfer frameworks

ISSUE	GDPR	KSA PDPL
Territorial analysis	Article 3 GDPR	Article 2 PDPL
International transfer framework	Chapter V GDPR	Article 29 PDPL + Transfer Regulation
Adequacy	Article 45 adequacy decisions	Article 3 Transfer Regulation mechanism
Contractual safeguards	Article 46 safeguards, including SCCs	Appropriate safeguards under the Transfer Regulation, including Saudi SCCs
Group mechanism	Binding Corporate Rules	Binding Common Rules
Transfer-risk assessment	Schrems II / SCC Clause 14 / relevant EDPB framework	Article 7 Transfer Regulation and relevant SDAIA guidance
Core governance lesson	Transfer mechanism must match the GDPR transfer route	Transfer mechanism must match the applicable Saudi transfer purpose, conditions and safeguard framework

Building one global transfer programme

The most effective model is to standardise the governance layer while localising the legal analysis.

A multinational organisation can maintain one central international transfer inventory recording, for example:

• exporter and importer;
• countries involved;
• systems and applications;
• categories of personal data;
• categories of data subjects;
• processing purposes;
• controller and processor roles;
• hosting and access locations;
• onward transfers;
• security measures; and
• relevant vendors and subprocessors.

The organisation can also standardise:

• vendor onboarding;
• contractual governance;
• transfer approval procedures;
• risk ownership;
• documentation requirements;
• periodic review processes; and
• escalation routes.

What should vary is the legal decision tree applied to each transfer.

For an EEA-originating transfer

The organisation may need to determine:

1. whether an EU adequacy decision applies;
2. if not, which Article 46 mechanism is appropriate;
3. which SCC module applies;
4. whether the relevant destination-country laws and practices affect the effectiveness of the safeguard;
5. whether supplementary measures are necessary; and
6. whether the transfer should be reassessed because circumstances have changed.

For a Saudi-originating transfer

The organisation may need to determine:

1. whether the transfer falls within a permitted Article 29 purpose;
2. whether the Article 29 conditions are satisfied;
3. whether an SDAIA adequacy determination is presently available for the destination;
4. whether an Article 4 exemption applies;
5. which appropriate safeguard is available in that specific scenario;
6. which Saudi SCC module or alternative safeguard should be used;
7. whether an Article 7 risk assessment is required; and
8. whether onward transfers comply with the applicable Saudi requirements.

This creates a framework in which the organisation does not unnecessarily duplicate its entire compliance architecture, while also avoiding the opposite mistake of forcing different privacy laws into one legal template.

One governance process. Different jurisdiction-specific legal pathways.

International privacy compliance increasingly involves overlapping regulatory frameworks rather than isolated national laws.

The GDPR can provide a strong foundation for multinational privacy governance because many organisations have already developed mature processes around data mapping, vendor management, SCCs, transfer assessments and accountability.

But operating in jurisdictions such as Saudi Arabia requires more than extending existing GDPR documentation to another group entity or adding a generic “international transfers” clause to a privacy policy.

Saudi Arabia has developed its own increasingly detailed transfer framework through:

• Article 29 PDPL;
• the Regulation on Personal Data Transfer Outside the Kingdom;
• Saudi Standard Contractual Clauses;
• Binding Common Rules;
• accreditation mechanisms; and
• a dedicated transfer-risk-assessment framework.

The practical challenge for multinational organisations is therefore to distinguish between the elements of privacy governance that can be standardised globally and the legal requirements that must remain jurisdiction specific.

That distinction is central to building international privacy programmes that can scale as organisations expand across markets.