What the PDPL requires
- Get consent before processing personal data, unless another legal basis applies, such as a contract with the person, a legal duty or a legitimate interest, which cannot cover sensitive data.
- Publish a privacy policy before collecting personal data, and tell people why you collect it and what their rights are.
- Transfer personal data outside the Kingdom only where the law allows: to a country SDAIA finds adequate, under approved safeguards such as standard contractual clauses, or under a listed exception.
- Allow data subjects to access, correct and delete their data.
- Notify SDAIA and affected users of qualifying personal-data breaches.
- Register on SDAIA’s national register of controllers where the rules require it, for example when your main activity is processing personal data or you process sensitive data.
What the banner does here
The same opt-in mode as in the EU and UK: non-essential cookies are blocked until the visitor chooses, with Reject all beside Accept all at the same size, and no pre-ticked boxes.
How GrantCookie covers it
- Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
- Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
- Withdrawing consent. A re-open control stays on every page, so visitors can withdraw or change their choice at any time.
This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.