The Legal Implications of the EU and Saudi Data Protection Regimes on Corporations: Compliance Challenges, Administrative Enforcement, and Emerging Disputes

Abstract

This dissertation conducts a comparative analysis of the legal implications of the European Union General Data Protection Regulation (GDPR) and the Saudi Personal Data Protection Law (PDPL) on corporations, focusing on three key issues: compliance challenges, administrative enforcement, and emerging disputes. While both regimes pursue similar objectives and share several features, they diverge significantly in their legislative approach and in the financial and managerial burdens imposed on corporations. The discussion of compliance challenges demonstrates that corporations under both frameworks are facing regulatory, financial, and implementation difficulties. The study further finds that although administrative enforcement in both regimes is mandated to a public authority equipped with deterrent and cooperative tools, corporations face harsher sanctions under the GDPR but benefit from greater procedural predictability compared with those subject to the PDPL. The analysis also shows that corporations under either regime may become involved in similar disputes arising from data protection provisions, and that both regimes adopt an implicit supportive stance towards referring intercorporate disputes to arbitration. The findings support that the PDPL offers a more business-friendly model in the context of administrative enforcement and emerging disputes, due to its comparatively soft sanctions and its role as a national instrument supplemented by domestic laws, which together provide a more predictable framework. This dissertation contributes to the understanding of the data protection challenges faced by corporations under both regimes and the pivotal role of public authorities in shaping a business-friendly jurisdiction.