Digital consent under the PDPL is a data subject's electronic acknowledgment accepting the processing of their personal data for a specific purpose, as required by the Saudi Personal Data Protection Law. To be valid, it must be given freely, be specific and clear, and be preceded by adequate information about the purpose, the entity and the data subject's rights. The entity responsible for processing bears the burden of proving it on request, so collecting consent is not enough; it must be documented in a record that proves who consented, to what, when and how.

We wrote this article for data protection officers and HR teams who collect consent from employees, applicants and customers. In it, we explain when consent is the appropriate lawful basis and when it is not, the conditions for its validity, how it is collected and proven electronically, and how withdrawal is managed.

Quick summary

• Consent is one of the lawful bases for processing data under the PDPL, not the only one, and choosing it where it is not needed may weaken the entity's position.
• Valid consent is free, specific, clear and preceded by information, and the data subject may withdraw it at any time.
• The burden of proving consent lies with the entity responsible for processing, so every acknowledgment needs a record documenting its details.
• In HR, much of the processing of employee data is based on the contract or a legal obligation, and consent is reserved for what goes beyond that.
• At Signit, we provide an audit trail that records who signed, when and from which device, with verification through Nafath and Absher and local data hosting.

What is consent under the Personal Data Protection Law?

Consent under the Personal Data Protection Law is explicit permission that the data subject gives to the entity responsible for processing, accepting the processing of their data for one or more specific purposes.

The Personal Data Protection Law was issued by Royal Decree No. (M/19) dated 9/2/1443 AH, amended by Royal Decree No. (M/148) dated 5/9/1444 AH, and came into force on 14 September 2023 with a grace period for compliance that ended in September 2024. Its application is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), and its Implementing Regulations set out the conditions for consent and how it should be documented.

Two terms recur throughout this article. The data subject is the individual the data relates to, such as an employee or a customer. The controller is the entity that determines the purpose and means of processing, which is usually the company itself.

When is consent the appropriate lawful basis?

Consent is appropriate when there is no other lawful basis for the processing, and when the data subject has a genuine choice to accept or refuse without being harmed.

Alongside consent, the law sets out several bases for processing, including performance of a contract to which the data subject is a party, compliance with a legal obligation, protection of vital interests, and the controller's legitimate interest within its conditions. Choosing the right basis is essential, because each basis entails different obligations.

The common mistake is making consent the basis for everything. If a company asks an employee to consent to the processing of their salary data and the employee then withdraws that consent, the company cannot stop paying the salary. Here, the correct basis is performance of the employment contract, and consent in the wrong place suggests a choice that does not exist.

What are the conditions for valid digital consent?

Consent is valid when it is given freely without coercion, is specific to a clear purpose, is preceded by adequate information, results from an affirmative act by the data subject, and can be withdrawn at any time.

Freedom means consent is not tied to a service that does not require the processing. Making consent to marketing messages a condition for completing a purchase means it is not freely given. In the employment relationship in particular, this condition needs care, because the imbalance between employer and employee can make refusal difficult in practice.

Specificity means consent is given for a particular purpose. Blanket consent to "any use the company sees fit" does not meet this condition. Where there are several purposes, it is better to obtain separate consent for each.

Prior information means that, before consenting, the data subject knows who the entity is, what the data is, why it is collected, who it is shared with and what their rights are. This is usually provided in a privacy notice, which is a statement the controller publishes about its processing practices.

Affirmative act means the data subject takes a clear action, such as ticking a box or signing. Pre-ticked boxes, or treating silence as acceptance, do not prove genuine consent.

How is digital consent proven?

Consent is proven by a record that documents the identity of the person who gave it, the specific version of the text they agreed to, the time of consent and the means by which it was given, with the record kept in a way that prevents tampering.

The law places the responsibility for proving consent on the controller. In the event of a complaint or inspection, it will not be enough to say that the employee or customer consented. What is required is evidence that answers specific questions.

Evidence becomes stronger when consent is collected on a document signed electronically through a licensed trust service provider, because the signature reveals any later change to the text. For details, see the article on the licensed trust service provider.

At Signit, we provide an audit trail that records who signed, when and from which device, and we enable signer verification through Nafath, Absher and Wathq, or through verification codes by email, SMS and WhatsApp. We host data inside the Kingdom and comply with the Personal Data Protection Law and the controls of the National Data Management Office.

How should HR handle consent?

HR starts by determining the lawful basis for each type of employee and applicant data, then reserves consent for what the contract or legal obligation does not cover, and documents it in a provable way.

Employee data passes through several stages: application, hiring, the period of employment and the period after the relationship ends. Each stage has different purposes. Applicant data is collected to assess the application, and keeping it for future vacancies is an additional purpose that requires consent. Employee data is processed to perform the contract, but using an employee's photo in a marketing campaign or sharing their data with an external training provider may go beyond that.

It is better to integrate consent into the digital onboarding journey instead of scattered paper forms. When a new employee signs their contract electronically, the optional consents can be presented separately from the contract, together with the privacy notice, and all of them kept in a single record. This makes them easier to refer back to and makes it clear to the employee that optional consents are not a condition of employment.

If your company is reviewing consent workflows in its contracts more broadly, we covered this in the article "The PDPL and your company's contracts: what to change in consent workflows now".

What are the common mistakes in collecting digital consent?

The most common mistake is bundling consent into the general terms and conditions. When consent to processing comes as one clause among dozens that the user accepts all at once, it is hard to prove that it was specific and informed. It is better to separate it, word it in clear language and present it at the right point in the journey.

Another is saving the result without the context. Some systems keep a "Consented: yes" field in the database, without a copy of the text the user agreed to or the time of consent. When the consent text later changes, no evidence remains of what the data subject actually accepted.

Some teams make the mistake of making withdrawal harder than giving consent. If consent takes a single click while withdrawal requires a formal letter or an in-person visit, this goes against the spirit of the law. Withdrawal should be available through the same channel and with the same ease, and it should be documented in the record.

Finally, where consents and their related data are stored is sometimes overlooked. The consent record contains personal data, and transferring it to servers outside the Kingdom is subject to the conditions of the law. To learn more, see the article "Data sovereignty and local hosting".

How do you build a system for collecting and proving consent?

Start by mapping your processing activities and determining their lawful basis, then design consent forms for those that need them, link them to the privacy notice and an audit trail, and set up the withdrawal mechanism.

Frequently asked questions

Conclusion

Digital consent is an important tool for complying with the Personal Data Protection Law, but its value is realized only when it is used in the right place and proven with complete evidence. Choosing the appropriate lawful basis, separating consents by purpose, linking them to a clear notice, documenting them in a record that keeps the identity, text and timing, and making withdrawal easy are what make consent defensible in any review.