Saudi Retailer BinDawood Reports Data Breach as Kingdom Penalizes PDPL Violations

A vulnerability in an e-commerce platform operated by Saudi Arabian retail group BinDawood exposed customer orders and personal data. The incident highlights the cybersecurity risks accompanying the retail sector’s digital transformation and tests companies’ responsibility to protect consumer information under the Personal Data Protection Law, or PDPL.

BinDawood recently disclosed the breach publicly, but reports did not specify when it occurred, how many people were affected or the amount of any losses. The Saudi Data and AI Authority, or SDAIA, said earlier this year that it had imposed penalties in 48 cases involving PDPL violations, without disclosing the fines in individual cases.