Start with the data you collect
Contact forms, newsletter sign-ups, booking and checkout pages, analytics and chat tools all collect personal data. List each one, what it collects and why, because everything else in this checklist builds on that list.
- Forms: name, e-mail, phone and message
- Accounts and orders: address, payment and purchase history
- Analytics and cookies: device and browsing data
- Third-party tools: chat, maps, video and advertising pixels
The law behind it
Your site is governed by Law No. 13 of 2016 on Personal Data Privacy Protection, overseen by the National Data Privacy Office. It sets rules on lawful processing, consent, security and the rights of the people whose data you hold. This is general guidance, not legal advice, so confirm details with a lawyer.
Tell people and ask properly
Publish a clear privacy notice in Arabic and English that says what you collect, why, how long you keep it and who receives it. Ask for consent where it is needed, make withdrawing it as easy as giving it, and avoid pre-ticked boxes.
Security and who handles your data
Use HTTPS, strong access control, regular updates and backups. Sign a written agreement with every provider that handles personal data for you, such as hosting, e-mail and payment services. The law lets you move personal data across borders only when appropriate safeguards are in place, so check where your hosting, email and analytics providers keep the data and what protects it.
Rights, breaches and penalties
Give people a simple way to ask for access, correction or deletion and answer within a reasonable time. Prepare a breach plan: you are expected to notify both the regulator and the people affected when a breach could cause serious harm, so know who decides and who writes the notice before something happens. Penalties can be heavy, with fines of up to millions of riyals for serious violations, so treat this as a business risk rather than a formality.