Saudi Arabia Data Protection & Privacy Regulation

Lawful Processing & Special Data

The draft amendments to the Personal Data Protection Law's Implementing Regulations propose removing the standalone definition of direct marketing currently found in the regulatory text. Commentary describes this as a structural drafting change requiring edits to every affected cross-reference wherever the defined term currently appears, rather than a substantive narrowing of what counts as direct marketing activity. Despite this structural change, the underlying lawful-basis gateway for processing, the Article 11 consent requirement, is reported to persist unchanged, meaning that the core lawful-processing test applicable to marketing and other processing activities does not appear to be weakened by the removal of the standalone definition.

This combination, removing a standalone definition while preserving the underlying consent gateway, suggests a consolidation or simplification exercise in the structure of the regulations rather than a substantive policy shift in what lawful bases are available or required for marketing-related processing. For controllers currently relying on the existing direct-marketing definition to scope their marketing-consent compliance programmes, the practical implication is a need to track how marketing activity is defined and treated once the standalone definition is removed and cross-references are redrafted, to confirm that consent-gateway compliance remains correctly scoped under the revised structure.

Outlook

The practical effect of the direct-marketing definition's removal will depend on how the redrafted cross-references ultimately treat marketing activity within the broader lawful-processing framework once the amendments are finalised following the 5 November 2026 consultation close, as scheduled. Controllers with marketing programmes should watch for the final text to confirm continuity of their consent-based compliance approach.

Controller/Processor Duties

Two controller-facing obligations are under active revision through the same Implementing Regulation consultation. The first concerns breach notification: the current regime gates the duty to notify the regulator of a personal-data breach behind a harm-assessment threshold, and the draft amendment would remove that threshold, broadening the circumstances in which notification to the authority becomes mandatory. The underlying harm-assessment text that the draft would replace was not itself retrieved verbatim for this review, so the precise before-and-after wording cannot yet be set out side by side; the direction of the change, however, is clear from the draft and from legal commentary on it.

The second concerns organisational duties: the draft revises the circumstances in which a controller must appoint a data protection officer, and introduces a mandatory National Register of Controllers obligation applying to public entities, to organisations whose core activity consists of data processing, to processing of sensitive data, and to any processing involving cross-border transfer or disclosure. Both elements remain proposals; neither is in force.

Outlook

If adopted as drafted, these changes would require affected controllers to review both their breach-response procedures and their registration and DPO-appointment status ahead of any effective date the authority eventually sets. The consultation closes 5 November 2026, and no adoption decision has been recorded as at the date of this note.

Controller/Processor Duties

The Implementing Regulations' Article 24 currently requires controllers to notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of a breach that may harm personal data or data subjects' rights, with no materiality self-assessment permitted under the current, in-force text. The draft amendments under consultation would preserve this no-threshold structure while being part of a broader package that also touches data protection officer administrative requirements and records-of-processing-activities obligations.

On the administrative side, commentary describes a proposed requirement for organisations to input their data protection officer's contact details into the National Data Governance Platform, centralising what may currently be a more fragmented administrative process. Separately, simplified records-of-processing-activities requirements are proposed, clarifying that records must be retained for a defined period, which would give controllers clearer guidance on retention duration than may currently exist. Taken together, these two administrative changes point toward streamlining certain compliance-process burdens even as the substantive breach-notification duty remains strict and threshold-free.

The absence of a materiality threshold for breach notification is a significant operational point for controllers and processors: any breach that may cause harm to personal data or to data subjects' rights triggers the 72-hour clock, regardless of the controller's own assessment of the breach's severity or likely impact. This places a premium on robust internal breach-detection and escalation processes capable of meeting a 72-hour notification window without the benefit of a materiality filter to exclude lower-risk incidents.

Outlook

Controllers and processors operating in Saudi Arabia should treat the no-threshold 72-hour breach-notification duty as a standing operational requirement that is not expected to loosen under the draft amendments. The proposed centralisation of data protection officer contact details into the National Data Governance Platform and the clarified records-of-processing-activities retention-period guidance are the two administrative changes to track for implementation once the amendments are finalised following the 5 November 2026 consultation close, as scheduled.

Cross-Border & Adequacy

The draft Implementing Regulation amendments under consultation would introduce, for the first time, an express requirement that personal data be stored within the Kingdom of Saudi Arabia. The same draft provision permits transfer or disclosure of data outside the Kingdom where the conditions set out in the Law and the Regulation are satisfied, so the proposal is framed as a localisation default paired with a conditional export permission rather than an outright prohibition on cross-border movement. This is a notable departure from the position reported previously, under which the Law did not require personal data to be stored or processed inside the Kingdom. The provision remains in draft; the consultation on it closes 5 November 2026 and the authority has not confirmed whether or in what form it will be adopted.

Outlook

Adoption of the localisation requirement, even subject to a transfer exception, would be the most significant change to the Kingdom's cross-border data regime since the Implementing Regulation first took effect. Organisations relying on offshore storage or processing arrangements involving data relating to the Kingdom have reason to watch the consultation outcome closely; the effective date, if the provision is adopted, is reported by secondary sources as 60 days after Gazette publication, though the regulator has not confirmed this timeline itself.

Cross-Border & Adequacy

The most significant proposed change in Saudi Arabia's current data protection reform package is a new draft Article 23(2), which would introduce a default requirement for controllers to store personal data within the Kingdom. Importantly, this default localisation requirement is paired with a continued permission for cross-border transfer or disclosure where the Personal Data Protection Law and its Implementing Regulations so provide, meaning the proposal does not amount to an absolute prohibition on cross-border data flows but rather shifts the default starting position from transfer-permitted to localisation-by-default, with transfer available as a provided-for exception rather than a general rule.

This development sits within a jurisdiction whose data protection framework is not part of the European Union's regulatory architecture, and whose cross-border transfer rules are instead a matter of the Kingdom's own Personal Data Protection Law and its separate Transfer Regulation. The direction of this proposed change, toward a default localisation posture, is consistent with a broader regional and global pattern of jurisdictions tightening default expectations around where personal data is stored, even as specific mechanisms for permitted cross-border transfer are preserved alongside that default.

For controllers and processors currently relying on cross-border data architecture, whether for group-level data processing, cloud infrastructure located outside the Kingdom, or cross-border service delivery, the practical significance of draft Article 23(2) is that any such architecture may need to be reassessed against a default localisation requirement once the amendments are finalised, with continued reliance on cross-border transfer dependent on qualifying under the Law and its Implementing Regulations. The consultation on this and the other draft amendments closes 5 November 2026, with the amendments, if approved, expected to take effect 60 days following publication in the official Gazette.

Outlook

Organisations with cross-border data architecture touching Saudi Arabia should treat the proposed default localisation requirement under draft Article 23(2) as the single most consequential item in this consultation cycle to monitor through to finalisation. Confirmation of which specific transfer mechanisms will qualify as provided-for exceptions under the finalised Law and Implementing Regulations will be the key detail to watch once the draft text moves toward adoption following the 5 November 2026 consultation close, as scheduled.

Cross-Border & Adequacy

SDAIA's draft amendments to the PDPL Implementing Regulations, published for consultation on 6 October 2026, list data localisation as the first Key Change among the proposed amendments, according to law-firm commentary on the consultation notice. The substantive operative text of the data-localisation provision, including its scope, the categories of data or processing activity it would apply to, and any thresholds or exemptions, has not yet been retrieved; the finding currently rests on the fact that data localisation appears first in SDAIA's own listing of Key Changes, as relayed by secondary commentary, rather than on the provision's actual drafted language.

This is nonetheless a significant signal in its own right. The prominence given to data localisation within SDAIA's consultation framing suggests that cross-border data transfer arrangements, currently governed by whatever baseline cross-border transfer mechanism exists under the PDPL's current Implementing Regulations, may be materially tightened once the amendments are finalised. Entities that currently process Saudi Arabia residents' personal data outside the Kingdom, whether through cloud infrastructure, group-wide data processing arrangements, or outsourced processing relationships, would be the natural constituency affected by any data-localisation requirement, though until the operative text is available, the precise compliance burden cannot be assessed with confidence.

The consultation period runs until 5 November 2026. If the amendments, including the data-localisation provision, are approved following that consultation, they would take effect sixty days after publication in the official Gazette, which would place a plausible effective date in the first quarter of 2027. This timeline gives affected entities a window, albeit currently an uncertain one given the unresolved substantive scope, to begin assessing their cross-border data architecture ahead of a possible early-2027 effective date.

No other cross-border or adequacy-related development for Saudi Arabia was evidenced this cycle. The data-localisation Key Change stands as the sole, though materially significant, finding in this module, and its ultimate impact will depend heavily on the operative text that has not yet been published or retrieved.

Outlook

The most consequential open question for this module is the substantive content of the data-localisation provision itself, which is expected to become clearer either during the consultation period, which closes 5 November 2026, or upon publication of the finalised amendments in the Gazette. Entities with cross-border data architecture touching Saudi Arabia residents' personal data should monitor for the release of the operative text, which will determine the actual scope and compliance implications of the data-localisation Key Change. Until that text is available, any assessment of impact remains necessarily provisional.

AdTech & Commercial Privacy

A further element of the same Implementing Regulation consultation would require consent before sending promotional or awareness-raising materials to any recipient, and would additionally require verification of consent where a controller instead relies on having an existing relationship with the recipient as its basis for sending such materials. This would extend the consent requirement beyond the narrower circumstances addressed under the current marketing provisions. The change is, again, a draft proposal open for comment until 5 November 2026 and is not yet in force.

Outlook

If adopted, the amendment would narrow the room controllers currently have to rely on an existing-relationship basis for sending marketing or awareness communications without separately verifying consent. Organisations running direct-marketing or customer-communication programmes touching the Kingdom should treat the consultation outcome as the next relevant marker, rather than the current text, which remains unchanged pending the authority's decision.

AdTech & Commercial Privacy

Marketing conducted without documented consent is reported as the most frequently cited violation category among the Saudi Data and Artificial Intelligence Authority's confirmed 2025 enforcement decisions, with continuing 2026 enforcement actions penalising mass messaging campaigns across SMS, WhatsApp, and email channels that lack documented consent from recipients. This sustained enforcement focus indicates that commercial marketing practices remain a leading area of active supervisory attention under the Personal Data Protection Law.

Against this enforcement backdrop, the draft amendments to the Implementing Regulations under consultation would make two changes relevant to commercial marketing practice. First, the standalone definition of direct marketing currently in the regulatory text would be removed, a structural drafting change requiring edits to all affected cross-references, while the underlying Article 11 consent requirement is reported to persist unchanged as the operative lawful basis for marketing activity. Second, a new requirement would be introduced obliging marketers to disclose the sender's identity when sending direct marketing material, adding a transparency obligation that sits alongside, rather than replacing, the existing consent requirement.

Read together, the enforcement pattern and the proposed amendments describe a consistent regulatory posture: documented consent remains the central lawful basis for marketing activity, and the authority continues to actively penalise its absence, while the proposed sender-identification requirement would add a further, distinct transparency obligation on top of the consent requirement rather than substituting for it. Organisations conducting direct marketing into the Saudi market, whether by SMS, WhatsApp, email, or other channels, should treat documented consent and, pending finalisation of the proposed changes, sender identification as the two central compliance points in this area.

Outlook

Continued active enforcement against marketing conducted without documented consent is the clearest pattern to expect going forward, consistent with the volume and categories seen in the confirmed 2025 enforcement decisions. The proposed sender-identification requirement for direct marketing material is a new obligation to track through to finalisation following the 5 November 2026 consultation close, as scheduled, alongside the broader fate of the direct-marketing definition's removal from the regulatory text.

Enforcement & Redress

No enforcement action, penalty decision or redress matter has been identified in the current window. The principal development bearing on this module is procedural rather than adjudicative: the Implementing Regulation consultation described elsewhere in this note would, if adopted, alter the breach-notification threshold that in turn affects when the regulator's enforcement machinery is engaged in the first place. No primary enforcement activity accompanies the consultation itself.

Outlook

Enforcement posture is likely to be shaped indirectly by the outcome of the Implementing Regulation consultation rather than by any pending case; a broadened breach-notification trigger, if adopted, would be expected to increase the volume of matters reaching the regulator's attention over time, though no such effect can yet be observed.

Enforcement & Redress

The Saudi Data and Artificial Intelligence Authority's Committees for Reviewing Violations of the Personal Data Protection Law confirmed 48 decisions finding violations during 2025, an outcome announced 16 January 2026. The violation categories cited across these decisions include processing without a legal basis, unauthorised disclosure, inadequate safeguards, and marketing without consent, with marketing without consent reported as the most frequently cited category overall. This enforcement-volume figure provides a concrete benchmark for the scale of the authority's active supervisory activity during what is a relatively early period in the Personal Data Protection Law's operative life, the Law itself having taken effect in September 2023.

The underlying penalty framework available to the authority's review committees, under Article 36 of the Personal Data Protection Law, allows for warnings or administrative fines of up to 5,000,000 Saudi riyals per violation, with that ceiling doubled for repeat violations. Separately, criminal liability under the Law can extend to imprisonment of up to two years alongside individual fines of up to 3,000,000 Saudi riyals for certain conduct, indicating that the Saudi enforcement regime carries both administrative and criminal dimensions depending on the nature and severity of the violation. The scale of these penalty ceilings, combined with the confirmed 2025 enforcement volume of 48 decisions, signals an active and consequential enforcement posture rather than a largely dormant penalty framework.

The pattern of cited violation categories, processing without a legal basis, unauthorised disclosure, inadequate safeguards, and marketing without consent, maps closely onto the core substantive obligations of the Personal Data Protection Law and its Implementing Regulations, suggesting that the authority's enforcement activity to date has concentrated on foundational compliance failures rather than more novel or technical areas of the Law.

Outlook

Continued enforcement activity at a comparable or increased volume to the 48 decisions confirmed for 2025 is the expected pattern for 2026, particularly given the authority's stated active focus on marketing-without-consent violations. Whether the draft amendments currently under consultation, if finalised, introduce any new enforcement priorities or penalty adjustments tied to the proposed localisation, breach-notification, or marketing provisions is a further point to watch once the amendments are finalised following the 5 November 2026 consultation close, as scheduled.

Enforcement & Redress

SDAIA confirmed, in a statement carried by the Saudi Press Agency on 16 January 2026, that its Committees for Reviewing Violations had issued 48 enforcement decisions under PDPL Article 36 over the preceding year. The amounts of individual decisions were not disclosed by SDAIA, limiting the ability to assess the scale or typical severity of penalties actually imposed, though the confirmed decision count itself indicates that the PDPL's enforcement machinery is operating with meaningful activity volume rather than remaining dormant following the law's implementation.

The available penalty framework, per Tier 3 commentary on PDPL Article 36, permits SDAIA's Committees for Reviewing Violations to issue warnings or administrative fines of up to SAR 5,000,000 per violation, doubled for repeat violations. Separately, unauthorised disclosure of sensitive data intended to cause harm carries a criminal penalty of up to two years' imprisonment and/or a fine of up to SAR 3,000,000. This combination of administrative and criminal exposure under a single statutory article gives Saudi Arabia's data protection enforcement regime a notably broader penalty range than a purely administrative-fine model, extending potential consequences for the most serious conduct, intentional harmful disclosure of sensitive data, into the criminal sphere.

Data subjects are understood to hold a right to claim compensation before the competent court for material or moral damage suffered as a result of a PDPL violation, according to secondary legal commentary; the pinpoint statutory article establishing this private right of action has not been independently retrieved this cycle. This private right of action exists alongside, rather than instead of, SDAIA's own administrative enforcement powers, giving affected data subjects a parallel avenue for redress distinct from any regulatory penalty SDAIA itself might impose on a controller or processor.

The confirmation of 48 decisions in the preceding year, read together with the available penalty ceiling of SAR 5,000,000 per violation, suggests an enforcement posture of active and recurring application rather than occasional or symbolic use of SDAIA's powers. However, because individual decision amounts remain undisclosed, it is not possible from the material available this cycle to assess what proportion of the 48 decisions approached the statutory maximum, nor to characterise the typical profile of a PDPL enforcement action under Article 36.

Outlook

The confirmed enforcement volume of 48 decisions over the preceding year establishes a baseline against which future enforcement-activity disclosures from SDAIA can be compared. Should SDAIA begin publishing individual decision amounts or further detail on the nature of violations underlying these decisions, future assessments of the PDPL enforcement regime's practical severity and targeting would be considerably strengthened. The interaction between this active enforcement posture and the pending PDPL Implementing Regulation amendments, including the data-localisation Key Change under consultation until 5 November 2026, is also worth monitoring, as any newly created obligations under the amended regulations would become a fresh basis for future Article 36 enforcement activity once in force.