When your site has a contact or booking form, you handle personal data: names, phone numbers, emails and sometimes more. Adding AI to the workflow raises two questions: where does that data go, and what are your duties as the owner.
Saudi Arabia has a Personal Data Protection Law (PDPL) with supporting regulations. Details and enforcement evolve, so treat the points below as orientation rather than a compliance checklist.
Collect only the personal data you need, tell people why, protect it, and be careful what you paste into any AI tool. Saudi Arabia has a personal data protection law, but this is general information, not legal advice: have a qualified adviser review your case.
Know what personal data you actually hold
List every place a visitor can type something: forms, chat, newsletter, bookings, payments. For each, write what is collected, why, and who can see it.
- Collect the minimum: do you really need a birth date?
- Avoid sensitive data unless essential to the service.
- Delete data you no longer need.
Be careful what you paste into AI tools
When you build or debug with AI, avoid pasting real customer records, ID numbers, health details or passwords. Use sample data instead. Read the terms of any service you connect to see how it processes and stores data.
Keep secrets such as API keys in project secrets, never inside page code visible to visitors.
Tell visitors clearly
A short, honest privacy page helps: what you collect, why, how long you keep it, who you share it with, and how to contact you to ask about their data. Place a link near every form.
- Plain language in Arabic, and English if you serve both.
- A contact route for access or deletion requests.
- Consent wording that matches what you really do.
Security basics and legal review
Use HTTPS, strong admin passwords, limited access for staff, and regular backups. Where data may leave the country or be shared with providers, ask a lawyer how the rules apply to you.
Example prompt to Uttra: "Add a privacy policy page in Arabic and English describing the data my booking form collects, add a consent checkbox with a link to it, and make sure the form only asks for name, phone and appointment time." Have the final text reviewed by a legal professional.