SDAIA Consults on Extensive Amendments to the Saudi PDPL Implementing Regulation

On 6 October 2026 the Saudi Data and Artificial Intelligence Authority (SDAIA) published draft amendments to the Implementing Regulation (the PDPL IRs) to the Kingdom of Saudi Arabia Personal Data Protection Law issued pursuant to Royal Decree No. (M/19) dated 09/02/1443 H (corresponding to 16/09/2021 G) (as amended) (the PDPL) for public consultation (the Proposed Amendments). 

The Proposed Amendments are far-reaching and go beyond mere drafting tweaks. If implemented, the Proposed Amendments would require those subject to the PDPL and PDPL IRs to make material adjustments, not only from a documentation perspective but also, potentially, from an operational perspective (see in particular ‘Data Localisation’, at (1), below). 

The public consultation on the Proposed Amendments (the Consultation) is open for the submission of responses until 5 November 2026. If approved, the Proposed Amendments would take effect sixty days from their publication in the Gazette, a relatively tight window to make any adjustments. 

SDAIA seeking input from stakeholders ahead of the implementation of the Proposed Amendments is reflective of the maturity and sophistication of the authority, which has become increasingly active in recent years, both in terms of the issuance of regulations, guidelines and rules, as well as through active engagement with controllers and processors (both inside and outside the Kingdom). 

Based on our initial review (see ‘Key Changes’, below) there are areas of the Proposed Amendments which would merit further clarification, and the Consultation provides a valuable opportunity for those likely to be affected by the Proposed Amendments to provide feedback; an opportunity which should be given serious consideration given the implications.

We set out a high-level (non-exhaustive) summary of the key changes which would be introduced to the PDPL IRs by the Proposed Amendments, below.

Key Changes

1. Data Localisation

The newly included draft Article 23(2) introduces an express requirement for data controllers (Controllers) to store personal data within the Kingdom of Saudi Arabia (KSA or the Kingdom). However, the text goes on to provide that: “personal data may be transferred or disclosed outside the Kingdom in accordance with the provisions of the Law and its Implementing Regulations.”

This creates a level of ambiguity which will be critical to resolve before the Proposed Amendments are formalised and implemented.

The text could be read as meaning that a Controller which is subject to the PDPL (and, thus PDPL IRs) must maintain a copy of personal data within the Kingdom, but that they may be permitted to also transfer personal data outside the Kingdom where such transfers are made in accordance with the PDPL (and, in particular the Transfer Regulations). 

Equally, it may be that the language does not change the current position at all and is rather intended to set a baseline position that personal data should be stored in the Kingdom, unless it is transferred or disclosed lawfully outside the Kingdom (without an obligation to maintain a local copy). 

If the former interpretation reflects SDAIA’s intention, this would mark a major policy shift and would give rise to significant operational challenges for businesses currently hosting personal data outside of the KSA and relying upon lawful transfer mechanisms to do so. 

2. Enhanced Privacy Policy Requirements

Building on Article 12 of the PDPL, which requires Controllers to make a privacy policy available before collecting personal data, a new Article 18 (Repeated) requires the privacy policy to:

• be written in clear, simplified and comprehensible language suited to the different levels of understanding of the categories of data subjects concerned; and
• use language consistent with the language customarily used to provide the relevant services or products to those data subjects.

3. Data Breach Notification

The definition of “Personal Data Breach” has been deleted in the draft amendments, together with a note providing that “the removal of the Paragraph shall require editing all affected texts wherever they appear in the Regulation.” However, the defined term “Personal Data Breach” has been used in the amended text at Article 24 relating to personal data breach notification obligations. 

The threshold for required notification of personal data breaches to SDAIA appears to have been lowered under the proposed amendments, with the removal of the requirement for “potential harm” to data subjects falling away. Equally, the notification requirement will now also be triggered where there is “damage” to personal data (although the term “corruption” was already present in the now-deleted definition of Personal Data Breach, meaning that this may ultimately not mark a significant widening of the notification obligation). 

In addition, there are certain tweaks to the contents of notification requirements, both with respect to notifications to SDAIA, and to affected data subjects.

4. Information Security 

Article 23(1) has been modified to provide that Controllers are required to apply the necessary security and technical measures to prevent the potential risks of personal data leakage, damage, or unauthorized access, or to mitigate their impact if they occur (whereas the current language is tied to the to-be-deleted definition of Personal Data Breach).

Further, it is clarified that only those who are subject applicable National Cybersecurity Authority (NCA) standards are required to comply with those (broadly speaking, this is those providing ‘Critical National Infrastructure’, as defined under the relevant NCA rules). For all others, the requirement is to comply with “recognized cybersecurity standards” (recognised by whom is unclear) and “best practices”. 

5. Data Protection Impact Assessments 

The triggers for a data protection impact assessment (DPIA) set out at Article 25 are restructured, and in some respects, widened. New or amended triggers include: 

• where the Controller is processing personal data relating to minors or individuals with partial or no legal capacity (no longer necessarily on a large scale or repetitive basis);
• processing is carried out on a large scale, or involves regular or systematic monitoring by its nature;
• “emerging technologies” are used (this term is undefined); and
• processing results in solely automated decisions affecting data subjects' rights or interests.

The DPIA contents requirements have also been amended. If implemented, Controllers will need to update their DPIA templates and any related guidance and processes to reflect the updated requirements. 

6. Advertising, Awareness and Marketing

Article 28(1) of the current version of the PDPL IRs implies that where there is “prior interaction between the controller and targeted recipient”, that consent is not required to send “advertising and or awareness materials”. 

Under the Proposed Amendments to Article 28, consent is now required for “sending promotional or awareness purposes” under all circumstances. The construction of the proposed provision would benefit from further clarity.

The intended distinction between the requirements at Article 28 and those at Article 29 (and, in fact, the necessity for both provisions) is also, in our view, an area which would benefit from close consideration in any response to the Consultation.

7. Data Protection Officers (DPOs)

The Consultation indicates that SDAIA’s Rules for the Appointment of DPOs will be repealed, with the relevant requirements instead being incorporated within the PDPL IRs. Within the Proposed Amendments:

1. the triggers for appointing a DPO have been adjusted;
2. Controllers must document the appointment and, immediately on appointment, provide the DPO's contact details via the SDAIA platform, updating them whenever the DPO is replaced; and
3. the DPO's responsibilities would include giving internal support and advice and promoting awareness, and checking that appropriate means are in place for data subjects to exercise their rights.

8. Data Subject Rights

Data controllers must still process rights requests within 30 days, extendable by up to 30 more days. The extension ground changes from "disproportionate effort" to "additional effort that is unexpected or unusual" or multiple requests, with advance notice and reasons needing to be given to the data subject. A request not fulfilled by the Controller within the period would be deemed automatically rejected (although data subjects may have a right to raise a complaint under such circumstances). 

Data controllers may also decline a request that is repeated without justification or requires unusual effort, but must give reasons and notify the data subject. "Manifestly unfounded" is no longer a listed ground for refusal.

There are various other tweaks throughout the data subject rights provisions, including that all information must be given in "appropriate and simplified" language. Previously this applied only where the data subject lacked full or partial legal capacity.

9. Mandatory Registration

The notes to the Proposed Amendments indicated that SDAIA’s Rules Governing the National Register of Controllers within the Kingdom would be repealed, with the relevant provisions being introduced within the PDPL IRs. 

The following entities would need to register with SDAIA via its online platform pursuant to the Proposed Amendments to Article 34:

• Public entities;
• Controllers whose core activity requires processing personal data;
• Controllers processing sensitive data or data of individuals lacking legal capacity; and 
• Controllers transferring data outside the Kingdom.

This requirement would appear to apply equally to non-KSA based Controllers (and, indeed, the final limb may be intended to capture all such Controllers). 

10. SDAIA Requests – Timeline 

Under the newly proposed Article 36 (Repeated) entities subject to the PDPL must respond to requests from SDAIA within 20 business days of receipt. An entity that cannot meet the deadline must request an extension with sufficient justification, which SDAIA may approve at its discretion.

11. Complaints 

The 90-day time limit for data subjects to file complaints set out in the current version of the PDPL IRs is removed under the Proposed Amendments and complainants are required to provide additional information. 

WHAT NEXT

The breadth and impact of the Proposed Amendments are sufficiently material that any party which is subject to the PDPL should review those carefully, and give serious consideration to providing their feedback in response to the Consultation. 

If you are a Controller located in the Kingdom, or processing personal data of individuals in the Kingdom, please do reach out to our team who would be happy to support in assessing the impact of the Proposed Amendments and / or developing a Consultation response ahead of the 5 November deadline.