--- title: "Saudi Arabia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/saudi-arabia/ source_html: /jurisdictions/saudi-arabia/index.html description: "Saudi Arabia data protection and privacy regulation: 10 categories, 126 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 0eff4953989feaaf7f591c460e3bdb2ac7d372bde2d819d2c4c2233159dad71b generator: "fe-fleet/md-twin@1.0" --- # Saudi Arabia Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Saudi Arabia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/saudi-arabia/), [World Payments](https://payments.gi/jurisdictions/saudi-arabia/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 126 claims · 96 sources in the cumulative register Download report (PDF) Expand all Saudi Arabia's Personal Data Protection Law has entered its first sustained enforcement phase. Data collected 2026-11-04 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties, Cross-Border & Adequacy (4 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SAUDI-ARABIA)[Build Report](/reports/?j=SAUDI-ARABIA)[Compare](/compare/?j=SAUDI-ARABIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Saudi Data and Artificial Intelligence Authority (SDAIA) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-11-05 SDAIA PDPL Implementing Regulation amendments consultation closes Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 126 Claims 3 Tier-1 sources Traffic-light mix 1 green 8 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 1,227 Full executive summary 548 ###### Latest update · 4 November 2026 #### Lead Signal Saudi Arabia's data protection authority has opened the most consequential revision of the Personal Data Protection Law's Implementing Regulation since the law took effect, with a public consultation on draft amendments running from 6 October 2026 to 5 November 2026. The draft package would, for the first time, write an express data-localisation requirement into the regulatory text, tighten the triggers for notifying the regulator of a personal-data breach, revise when a data protection officer must be appointed and when a controller must register, and widen the reach of consent requirements around promotional and awareness messaging. None of this is yet in force: the changes remain proposals under consultation, and secondary reporting indicates that, if adopted, they would take effect 60 days after publication in the Official Gazette. #### Other Developments There is no other material movement to report this period across the remaining modules in scope. #### Cross-Monitor Connections The proposed data-localisation requirement and the tightened breach-notification trigger both touch arrangements that financial-integrity and world-payments readers maintain with counterparties processing or storing personal data in connection with the Kingdom; those monitors should track the consultation outcome independently rather than relying on this note to re-analyse the payments or financial-crime dimensions. #### Outlook The consultation window closes on 5 November 2026. Secondary reporting places a prospective effective date of 4 January 2027, calculated as 60 days after an assumed Official Gazette publication, though the regulator has not itself confirmed either the adoption decision or a publication date. Businesses processing personal data in or relating to the Kingdom face a period of regulatory uncertainty until the authority either finalises, revises, or withdraws the draft package. 3 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Saudi Arabia's Personal Data Protection Law has entered its first sustained enforcement phase. SDAIA's specialized enforcement committees issued 48 decisions against PDPL violators over the year preceding a February 2026 report, the first substantive enforcement wave since the law became fully enforceable on 14 September 2024. The most commonly cited violation was sending marketing and promotional messages without prior consent, a pattern SDAIA found widespread across retail, telecommunications, and financial services. SDAIA also identified processing without a lawful basis, unlawful collection or processing, and insufficient technical and organizational security controls among its common findings. The wave coincided with SDAIA's 16 February 2026 publication of Rules Governing the Issuance of Accreditation Certificates for Controllers and Processors, adding a formal certification layer to the compliance ecosystem. #### Other Developments SDAIA is the designated regulator under the PDPL and exercises quasi-judicial enforcement powers through specialized committees. The PDPL was enacted by Royal Decree M/19 -- dated 17 September 2021 in the source consulted this cycle, though independent secondary sources place the underlying conversion a day earlier, on 16 September 2021, so the exact decree date should be treated as unsettled -- and amended on 21 March 2023. The law covers purpose limitation and data-minimization principles, controller registration and ROPA obligations, data subject rights, and penalties, and applies extraterritorially to entities inside and outside the Kingdom processing the personal data of Saudi citizens and residents. Controllers must register through the National Data Governance Platform, an electronic portal carrying an annual fee, and must maintain and register a Record of Processing Activities with SDAIA. The 2023 amendments are understood to have introduced a legitimate-interest lawful basis, excluded for sensitive personal data, narrowing the law's earlier consent-primary default while remaining narrower than the GDPR's six enumerated grounds. Implementing Regulation Articles 28 and 29 require consent for promotional processing, subject to a narrow prior-interaction exemption, and for direct-marketing communications, where no exemption applies -- the most-cited enforcement violation this cycle. The PDPL's special-category list is reported to diverge from the GDPR by including tribal origin and credit data as sensitive categories, a divergence best read on the PDPL's own terms rather than as a GDPR deficiency. Articles 26 and 27 impose additional restrictive measures, including a need-to-know access approach, on health and credit data. On data subject rights, the Implementing Regulation permits verbal requests under an authentication mandate and prohibits fees for excessive or repetitive requests while allowing justified rejection of them; no fixed statutory response window was identified. Article 28 allows reliance on legitimate interest for profiling and direct marketing, subject to the data subject's right to object. Controller duties were substantially populated this cycle: documented privacy impact assessments are required across nine defined scenarios; controllers must periodically assess processors they select while retaining sole accountability before SDAIA; and Article 23 requires security measures referencing National Cybersecurity Authority standards. On breach notification, a challenger-fold correction this cycle established that the Implementing Regulation requires notice to SDAIA within 72 hours and to affected data subjects without undue delay where the breach is likely to cause harm to their rights and interests, softening an earlier characterization of the data-subject standard as immediate. Cross-border transfer rules liberalized substantially in 2023. The Cross-Border Data Transfer Regulation now permits transfers on three grounds -- an adequacy decision, appropriate safeguards such as standard contractual clauses or binding common rules, or specific derogations -- replacing the original PDPL's prohibition-first default. SDAIA is understood to be empowered to issue adequacy decisions for destination countries, sectors, and international organizations, though no published list of adequate jurisdictions was located this cycle. The Regulation mandates a Transfer Impact Assessment for transfers lacking an adequacy decision, and a transfer must be stopped if it impacts national security or the Kingdom's interests. Sectoral overlays were also confirmed: the SAMA Cybersecurity Framework applies to banks, insurers, financing companies, and credit bureaus, and the National Cybersecurity Authority's Essential Cybersecurity Controls apply to critical national infrastructure operators. On algorithmic governance, SDAIA is understood to have opened a public consultation on a draft Responsible AI Policy, a non-binding instrument sitting outside the core PDPL. On children and vulnerable groups, the PDPL's data-subject definition is reported to extend to a representative or legal guardian, but no dedicated parental-consent mechanism or age threshold was identified despite targeted searches. Finally, the PDPL provides penalties of imprisonment of up to two years and/or fines of up to SAR 5 million, approximately EUR 1.1 million. #### Cross-Monitor Connections The SAMA Cybersecurity Framework's application to regulated banks, insurers, financing companies, and credit bureaus is relevant to the financial-integrity monitor's coverage of Kingdom financial-sector data-security obligations. The same perimeter, together with Article 27's credit-data restrictions, intersects with payments-data flows tracked by the world-payments monitor. SDAIA's draft Responsible AI Policy sits adjacent to the PDPL's profiling provisions but is better analyzed as an AI-governance instrument; readers tracking that thread should consult the artificial-intelligence monitor. #### Outlook The jurisdiction's risk posture is now assessed as elevated and escalating, with the enforcement wave and the new licensing framework signaling a regulatory direction that is tightening roughly seventeen months after the PDPL's full applicability took hold. Structural gaps remain relative to the GDPR: no explicit data-portability right, no fixed statutory response window for data subject requests, no PDPL-specific cookie or dark-pattern regime, and no private right of action or collective-redress mechanism distinct from SDAIA's administrative process. A sourcing caveat also carries forward: this baseline's Confirmed-tier claims rest substantially on T2/T3 secondary legal-tracker analysis rather than directly retrieved primary legal text, flagged for reconciliation next cycle. Read full brief · 1227 words ###### Latest update · 25 October 2026 #### Regulatory Status Saudi Arabia's data protection framework is in an active tightening phase, led by the Saudi Data and Artificial Intelligence Authority's draft amendments to the Personal Data Protection Law's Implementing Regulations, published 6 October 2026 with consultation closing 5 November 2026. The most significant proposed change is a default data-localisation requirement under draft Article 23(2), paired with a no-threshold 72-hour breach-notification duty under draft Article 24 that removes any materiality self-assessment option. Administrative streamlining is proposed in parallel, including consolidated data protection officer contact-detail submission and simplified records-of-processing-activities retention guidance. Direct-marketing provisions are also affected: the standalone direct-marketing definition would be removed while the Article 11 consent gateway persists, and a new sender-identification requirement for marketing material is proposed. Enforcement activity remains strong, with 48 confirmed violation decisions for 2025 announced 16 January 2026, marketing without consent the leading cited category, and penalties reaching up to 5,000,000 Saudi riyals per violation under Article 36, doubled for repeats, alongside potential criminal liability. #### Outlook The 5 November 2026 consultation close and the prospective 60-day post-Gazette commencement period that would follow approval are the key near-term markers, as scheduled. The default localisation requirement and no-threshold breach-notification duty are the provisions most likely to require immediate controller and processor attention once finalised. ###### Standing brief · as of 26 August 2026 #### Regulatory Status Saudi Arabia's data protection regime centers on the Personal Data Protection Law, enacted by Royal Decree M/19 and now fully in force under the Saudi Data and Artificial Intelligence Authority, which registers controllers through the National Data Governance Platform and requires Record of Processing Activities filings. A 2023 amendment introduced a legitimate-interest lawful basis alongside the law's original consent-primary model, while Implementing Regulation Articles 28 and 29 keep consent mandatory for promotional messaging and, without exception, for direct marketing. The Cross-Border Data Transfer Regulation now permits transfers on an adequacy decision, appropriate safeguards, or derogations, replacing the law's original transfer prohibition, though SDAIA has not yet published a list of adequate destination countries. Controllers face nine defined scenarios triggering mandatory privacy impact assessments, a 72-hour SDAIA breach-notification deadline paired with a data-subject standard of notice without undue delay where harm is likely, and security obligations referencing National Cybersecurity Authority standards. Sector-specific overlays from SAMA and the National Cybersecurity Authority apply to financial institutions and critical-infrastructure operators respectively. #### Outlook SDAIA's specialized committees issued 48 enforcement decisions in the year to February 2026, the law's first substantive enforcement wave, dominated by marketing sent without consent and by inadequate security controls. The 16 February 2026 publication of accreditation and licensing rules for controllers and processors adds a certification layer to this tightening compliance landscape. The jurisdiction's risk posture is accordingly assessed as elevated and escalating. Notable structural gaps persist: no explicit data-portability right, no fixed statutory deadline for responding to data subject requests, no dedicated cookie, tracker, or dark-pattern regime, no biometric-specific regime, no dedicated parental-consent or minor-profiling framework, and no private right of action or collective-redress mechanism outside SDAIA's own administrative process. A portion of this cycle's Confirmed-tier findings rest on secondary legal-tracker sources rather than directly retrieved primary legal text, a gap earmarked for reconciliation in a subsequent cycle. Read full brief · 548 words Key regulatory facts for Saudi Arabia Regulatory Dimension Saudi Arabia Standing Position Jurisdiction Saudi Arabia (SA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 126 sourced findings) Regulator & Framework Comprehensive omnibus statute in force with an operational regulator, implementing regulations, and an active registration platform. Lawful Processing & Special Data Lawful-basis regime is narrower than GDPR (fewer enumerated grounds; legitimate interest only added by 2023 amendment and excluded for sensitive data), creating residual compliance friction. Data Subject Rights Core rights exist and are binding, but response-window specificity and portability provisions are thinner than GDPR, creating operational ambiguity flagged by practitioners. Controller/Processor Duties Core accountability infrastructure (DPIA, DPO, ROPA, breach notification) is binding and operative, but the immediate data-subject breach notification standard (rather than a risk-based threshold) is flagged by... Primary Instruments Cited OneTrust DataGuidance, IAPP, IAPP, Clyde & Co, Clyde & Co Last Confirmed / Updated 2026-11-04 (96 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Saudi Arabia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive omnibus statute in force with an operational regulator, implementing regulations, and an active registration platform. Primary framework Personal Data Protection Law (PDPL), Royal Decree M/19 (17 Sept 2021), as amended 21 March 2023, with Implementing Regulations and Cross-Border Data Transfer Regulation (effective 14 Sept 2023, fully enforceable 14 Sept 2024) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Green Comprehensive omnibus statute in force with an operational regulator, implementing regulations, and an active registration platform. #### Sub-modules (5) #### Regulator And AuthorityGreen SDAIA is the designated data protection regulator under the PDPL, exercising quasi-judicial enforcement powers through specialized committees. Claims (5): - The Saudi Data and Artificial Intelligence Authority (SDAIA) is the designated regulator for the Personal Data Protection Law. - SDAIA is the competent authority responsible for supervising and enforcing the PDPL, with a mandate extending to national data governance and AI strategy. - Saudi Data and Artificial Intelligence Authority (SDAIA) — The PDPL and its regulations came into force on 14 September 2023, followed by a one-year grace period that ended on 14 September 2024, since which date the PDPL has been fully enforceable under SDAIA. - SDAIA is the competent authority for PDPL enforcement, combining data-protection and AI policy functions. - Saudi Data and Artificial Intelligence Authority (SDAIA) — Continuing competent authority for the PDPL; initial two-year Council of Ministers designation lapsed September 2025 with no transfer to NDMO #### Act And InstrumentsGreen The PDPL, as amended, together with its Implementing Regulations and the Regulations on Personal Data Transfers, form the primary instrument set. Claims (5): - The Personal Data Protection Law was implemented by Royal Decree M/19 of 17 September 2021 approving Resolution No. 98, and amended on 21 March 2023. - SDAIA — Draft amendments to the PDPL Implementing Regulations published 6 October 2026 for consultation closing 5 November 2026; if approved, effective 60 days from Gazette publication. - The PDPL Implementing Regulations were published 7 September 2023, one week before the PDPL's 14 September 2023 entry into force. - SDAIA — On amendments to the PDPL Implementing Regulation (announced 4 Aug 2026), comment period to 5 November 2026; no amendment finalised. - Personal Data Protection Law (PDPL) — In force since 14 September 2023 #### Material ScopeGreen The PDPL covers personal data processing principles (purpose limitation, minimization), controller obligations, registration/ROPA, data subject rights, and penalties. Claims (1): - The PDPL covers key principles such as purpose limitation and data minimization, controller obligations including registration and maintenance of data processing records, data subject rights, and penalties for breach of provisions. #### Territorial ScopeGreen The PDPL has extraterritorial effect, applying to entities inside and outside the Kingdom that process personal data of Saudi citizens or residents. Claims (4): - The PDPL applies to all entities, whether based inside or outside the Kingdom, that process the personal data of Saudi citizens or residents, and also extends to individuals who collect personal data of others. - Personal Data Protection Law (PDPL) — Any entity processing personal data of individuals located in Saudi Arabia, regardless of the entity's own location. - PDPL — Non-KSA processors handling KSA residents' data, per secondary commentary - PDPL Art 2(1)-(2) — PDPL applies to processing of personal data in the Kingdom and to processing of data of Kingdom residents by any party anywhere, excluding purely personal/family use not disclosed to others #### Regulator Registration And FilingAmber Controllers must register via an electronic portal (National Data Governance Platform) with an annual fee and maintain a Record of Processing Activities (ROPA) registered with SDAIA. Claims (6): - Data controllers must register via an electronic portal which includes an annual registration fee. - Data controllers must create and maintain a record of how they process personal data, and it must be registered with the SDAIA. - SDAIA — On the National Data Governance Platform enabling overseas organisations (previously blocked by a commercial-registration requirement) to register as controllers. - SDAIA launched a public consultation (open through 27 May 2025) on proposed amendments to the PDPL Implementing Regulations, including changes to DPO appointment rules and controller registration/oversight obligations; final adoption status not independently confirmed. - National Data Governance Platform (NDGP) — Controller must register on the NDGP where it is a public entity, processes sensitive data, or processing personal data is its main activity in the Kingdom - National Data Governance Platform (NDGP) registration — No registration fee currently applies Saudi Arabia's Personal Data Protection Law (PDPL), enacted by Royal Decree M/19 and amended in March 2023, is a GDPR-style omnibus statute administered by the Saudi Data and Artificial Intelligence Authority (SDAIA). The law and its Implementing Regulations/Cross-Border Data Transfer Regulation have been fully in force and enforceable since 14 September 2024, following a phased transition period. Periodic update · new data 2026-11-04 #### Regulator & Framework The Saudi Data and Artificial Intelligence Authority has opened a public consultation on a substantial package of amendments to the Implementing Regulation of the Personal Data Protection Law, running from 6 October 2026 to 5 November 2026. The package is wide-ranging: it touches cross-border data handling, breach notification, the circumstances requiring a data protection officer and controller registration, and the scope of consent for direct marketing. None of these changes has been adopted; they remain proposals open for comment, and the authority has not itself confirmed a decision date or an Official Gazette publication date. Secondary legal commentary places a likely effective date 60 days after eventual publication, but this figure comes from third-party reporting rather than from the regulator directly, and should be read as indicative rather than confirmed. #### Outlook The consultation closes 5 November 2026. Whether and in what form the draft provisions are adopted will determine the shape of the Kingdom's data protection framework going into 2027; the authority's own confirmation of a Gazette publication date would be the next concrete marker to watch. 2 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework The Saudi Data and Artificial Intelligence Authority, which combines data-protection enforcement with artificial-intelligence policy functions, published draft amendments to the Personal Data Protection Law's Implementing Regulations on 6 October 2026. The consultation on these draft amendments closes 5 November 2026, and if the amendments are approved as proposed, they would take effect 60 days following publication in the official Gazette. This places the authority in an active rule-making posture this period, with a defined and relatively near-term timeline running from the consultation close through to a prospective commencement date. The draft amendments described in available commentary are extensive, touching cross-border data transfer rules, breach-notification obligations, data protection officer administrative requirements, records-of-processing-activities obligations, and direct-marketing provisions. This breadth suggests the authority is using this consultation cycle to make a comprehensive update to the Implementing Regulations rather than a narrow, single-issue amendment, which is consistent with a data protection framework still maturing since the Personal Data Protection Law's own effective date in 2023. No primary Saudi Data and Artificial Intelligence Authority website page was directly retrieved and quoted confirming the draft amendment text this period; the available findings rest on corroborating commentary from multiple independent legal and compliance publishers describing the same consultation, instrument, and dates consistently. #### Outlook The 5 November 2026 consultation close is the immediate date to track, as scheduled. Whether the authority publishes a final version of the amendments that matches the draft text described in current commentary, and the precise date from which the 60-day commencement period would run, are the two open questions most likely to be resolved in the near term following the consultation close. Periodic update · new data 2026-10-18 #### Regulator & Framework SDAIA published draft amendments to the PDPL Implementing Regulations for public consultation on 6 October 2026, with the window closing 5 November 2026. This is corroborated by two independent law-firm summaries describing the same SDAIA consultation notice, giving the fact of the consultation itself a reasonably solid secondary-source basis, though the primary SDAIA notice has not been independently retrieved. If approved, the amendments are understood to take effect sixty days after publication in the official Gazette, which would place a plausible effective date in the first quarter of 2027, though this remains contingent on the outcome of the consultation and is not yet confirmed. SDAIA is understood to be the competent authority responsible for administering the PDPL, with an allocation of authority stated as being without prejudice to the Saudi Central Bank's powers over the entities that the Saudi Central Bank regulates. This carve-out is reported via a Tier 4 industry guide rather than a pinpoint statutory citation, and the exact article establishing the division of regulatory responsibility between SDAIA and the Saudi Central Bank has not been independently retrieved this cycle. Entities operating in or adjacent to the financial sector in Saudi Arabia should therefore be aware that data-protection compliance questions may, in practice, engage both SDAIA and the Saudi Central Bank depending on the nature of the processing and the regulated status of the entity concerned, though the precise contours of this dual-authority arrangement remain to be clarified by primary source material. The PDPL's territorial reach is understood, per secondary legal commentary, to extend to non-Saudi Arabia processors handling the personal data of Saudi Arabia residents. This extraterritorial scope, if accurately characterised, places Saudi Arabia's data protection regime within a broader international pattern of residence-based rather than purely establishment-based jurisdictional reach. As with the competent-authority allocation, the specific statutory provision establishing this territorial scope has not been independently retrieved this cycle, and the characterisation rests on law-firm secondary commentary rather than a pinpoint citation to the PDPL text itself. Taken together, these three elements, the draft amendment consultation, the SDAIA-Saudi Central Bank authority allocation, and the extraterritorial scope, describe a regulatory framework that is actively being refined through SDAIA's rulemaking process while resting, for several of its foundational features, on secondary rather than primary-source confirmation. This is a framework in active development rather than a settled, fully primary-sourced regime at this point in its maturity. #### Outlook The consultation on the draft PDPL Implementing Regulation amendments closes 5 November 2026. The period immediately following closure should be watched for SDAIA's response to consultation feedback and, eventually, for publication of the finalised amendments in the official Gazette, which would trigger the sixty-day countdown to effectiveness. Primary-source confirmation of both the competent-authority allocation between SDAIA and the Saudi Central Bank, and the PDPL's precise territorial-scope provision, would strengthen the evidentiary basis for assessments of Saudi Arabia's regulatory framework in future cycles. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (21) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdiction/saudi-arabia) — The Saudi Data and Artificial Intelligence Authority (SDAIA) is the designated regulator for the Personal Data Protection Law. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdiction/saudi-arabia) — The Personal Data Protection Law was implemented by Royal Decree M/19 of 17 September 2021 approving Resolution No. 98, and amended on 21 March 2023. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdiction/saudi-arabia) — The PDPL covers key principles such as purpose limitation and data minimization, controller obligations including registration and maintenance of data processing records, data subject rights, and penalties for breach of provisions. - [IAPP](https://iapp.org/news/a/saudi-pdpl-s-first-anniversary-amendments-enforcement-and-ongoing-developments) — The PDPL applies to all entities, whether based inside or outside the Kingdom, that process the personal data of Saudi citizens or residents, and also extends to individuals who collect personal data of others. - [IAPP](https://iapp.org/news/a/how-to-prepare-for-saudi-arabias-personal-data-protection-law) — Data controllers must register via an electronic portal which includes an annual registration fee. - [IAPP](https://iapp.org/news/a/how-to-prepare-for-saudi-arabias-personal-data-protection-law) — Data controllers must create and maintain a record of how they process personal data, and it must be registered with the SDAIA. - [Clyde & Co](https://www.clydeco.com/en/insights/2026/10/sdaia-publishes-draft-amendments-to-the-pdpl) — SDAIA — Draft amendments to the PDPL Implementing Regulations published 6 October 2026 for consultation closing 5 November 2026; if approved, effective 60 days from Gazette publication. - [Clyde & Co](https://www.clydeco.com/en/insights/2026/10/sdaia-opens-controller-registration-for-overseas-o) — SDAIA — On the National Data Governance Platform enabling overseas organisations (previously blocked by a commercial-registration requirement) to register as controllers. - [SGC Consulting](https://www.sgc.consulting/sdaia-saudi-personal-data-protection-law-pdpl-compliance-guide/) — SDAIA is the competent authority responsible for supervising and enforcing the PDPL, with a mandate extending to national data governance and AI strategy. - [Clyde & Co](https://www.clydeco.com/en/insights/2026/10/sdaia-publishes-draft-amendments-to-the-pdpl) — The PDPL Implementing Regulations were published 7 September 2023, one week before the PDPL's 14 September 2023 entry into force. - [National Law Review](https://natlawreview.com/article/saudi-arabia-proposes-significant-data-protection-changes-what-global-businesses) — SDAIA launched a public consultation (open through 27 May 2025) on proposed amendments to the PDPL Implementing Regulations, including changes to DPO appointment rules and controller registration/oversight obligations; final adoption status not independently confirmed. - [https://securiti.ai/saudi-arabia-personal-data-protection-law/](https://securiti.ai/saudi-arabia-personal-data-protection-law/) — Saudi Data and Artificial Intelligence Authority (SDAIA) — The PDPL and its regulations came into force on 14 September 2023, followed by a one-year grace period that ended on 14 September 2024, since which date the PDPL has been fully enforceable under SDAIA. - [https://www.dataguidance.com/jurisdictions/saudi-arabia](https://www.dataguidance.com/jurisdictions/saudi-arabia) — SDAIA — On amendments to the PDPL Implementing Regulation (announced 4 Aug 2026), comment period to 5 November 2026; no amendment finalised. - [Global Privacy Blog](https://www.globalprivacyblog.com/2026/05/active-enforcement-of-saudi-arabia-privacy-regime-implications-for-businesses/) — Personal Data Protection Law (PDPL) — Any entity processing personal data of individuals located in Saudi Arabia, regardless of the entity's own location. - [Reed Smith](https://www.reedsmith.com/our-insights/blogs/viewpoints/102o5at/sdaia-consults-on-extensive-amendments-to-the-saudi-pdpl-implementing-regulation/) — SDAIA is the competent authority for PDPL enforcement, combining data-protection and AI policy functions. - [National Law Review](https://natlawreview.com/article/saudi-arabia-proposes-significant-data-protection-changes-what-global-businesses) — PDPL — Non-KSA processors handling KSA residents' data, per secondary commentary - [Bureau of Experts at the Council of Ministers](https://ncar.gov.sa/api/index.php/resource/eyJpdiI6IjJqNGRvYkJoSDJGbjJwUkxMNUxCcUE9PSIsInZhbHVlIjoiSlFsU2JWRFpKTnBGcHE2dWdITUNMUT09IiwibWFjIjoiMTg3YzQwNjM5ODgzMzlmNjJhYWY3YWZkZjJmZWMyZmNlYmVmNTk5NmFiNzBlN2Q2NjQ1NDMwODY5NzhkNTBmMSIsInRhZyI6IiJ9/Documents/TranslatedAttachPath) — Personal Data Protection Law (PDPL) — In force since 14 September 2023 - [Securiti](https://securiti.ai/saudi-arabia-personal-data-protection-law/) — Saudi Data and Artificial Intelligence Authority (SDAIA) — Continuing competent authority for the PDPL; initial two-year Council of Ministers designation lapsed September 2025 with no transfer to NDMO - [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPLCP/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziPR1dzTwMgw2MDMOcTA3MjH39TE29jY0MQsz1w9EUhIZZAhUEGvl6OXoaGwQY60cRo98AB3A0IKTfi5ACoA-MinydfdP1owoSSzJ0M_PS8vUjAlwCfJwDgLZH4dVvYYyhANODYAV4fBCcWKRfkBsaUeWTFuyp66gIABC_KT0!/dz/d5/L0lHSkovd0RNQU5rQUVnQSEhLzROVkUvZW4!/) — PDPL Art 2(1)-(2) — PDPL applies to processing of personal data in the Kingdom and to processing of data of Kingdom residents by any party anywhere, excluding purely personal/family use not disclosed to others - [Morgan Lewis](https://www.morganlewis.com/blogs/sourcingatmorganlewis/2024/12/saudi-arabias-personal-data-protection-law-a-guide-to-registering-as-a-data-controller) — National Data Governance Platform (NDGP) — Controller must register on the NDGP where it is a public entity, processes sensitive data, or processing personal data is its main activity in the Kingdom - [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://dgp.sdaia.gov.sa/wps/portal/pdp/Registration/evidences/Rulesandguidelines/) — National Data Governance Platform (NDGP) registration — No registration fee currently applies ### Saudi Arabia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful-basis regime is narrower than GDPR (fewer enumerated grounds; legitimate interest only added by 2023 amendment and excluded for sensitive data), creating residual compliance friction. Primary framework PDPL (as amended) Arts. 5-6 and Implementing Regulation Art. 16 Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Lawful-basis regime is narrower than GDPR (fewer enumerated grounds; legitimate interest only added by 2023 amendment and excluded for sensitive data), creating residual compliance friction. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data The draft amendments to the Personal Data Protection Law's Implementing Regulations propose removing the standalone definition of direct marketing currently found in the regulatory text. Commentary describes this as a structural drafting change requiring edits to every affected cross-reference wherever the defined term currently appears, rather than a substantive narrowing of what counts as direct marketing activity. Despite this structural change, the underlying lawful-basis gateway for processing, the Article 11 consent requirement, is reported to persist unchanged, meaning that the core lawful-processing test applicable to marketing and other processing activities does not appear to be weakened by the removal of the standalone definition. This combination, removing a standalone definition while preserving the underlying consent gateway, suggests a consolidation or simplification exercise in the structure of the regulations rather than a substantive policy shift in what lawful bases are available or required for marketing-related processing. For controllers currently relying on the existing direct-marketing definition to scope their marketing-consent compliance programmes, the practical implication is a need to track how marketing activity is defined and treated once the standalone definition is removed and cross-references are redrafted, to confirm that consent-gateway compliance remains correctly scoped under the revised structure. #### Outlook The practical effect of the direct-marketing definition's removal will depend on how the redrafted cross-references ultimately treat marketing activity within the broader lawful-processing framework once the amendments are finalised following the 5 November 2026 consultation close, as scheduled. Controllers with marketing programmes should watch for the final text to confirm continuity of their consent-based compliance approach. D2 · Lawful Processing — Full Module Record 4 sub-modules · 40 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core rights exist and are binding, but response-window specificity and portability provisions are thinner than GDPR, creating operational ambiguity flagged by practitioners. Primary framework PDPL (as amended), Implementing Regulation Arts. on data subject requests Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Core rights exist and are binding, but response-window specificity and portability provisions are thinner than GDPR, creating operational ambiguity flagged by practitioners. #### Sub-modules (5) #### Access RightAmber Data subjects may submit requests, including verbal requests under an authentication mandate in the Implementing Regulation. Claims (2): - The Implementing Regulation permits verbal data subject requests under an authentication mandate, which is regarded as an operational burden on controllers. - Right to access and portability (Art.4(2),(3) PDPL) — Data subjects have a right to access their personal data and a right to obtain it in a readable, clear format #### Rectification And ErasureAmber Controllers may reject excessive/repetitive DSRs with justification but cannot charge fees for them. Claims (2): - There is no allowance under the Implementing Regulation for data controllers to charge data subjects for DSRs deemed excessive or repetitive, though controllers can reject such requests with justification. - Right to erasure (Art.4 PDPL) — Data subjects may request destruction of their personal data once no longer needed, without prejudice to Art.18 retention duties #### Restriction And ObjectionAmber A right to object to profiling/direct marketing is provided via Implementing Regulation Art. 28, paralleling GDPR Art. 21. Claims (1): - Implementing Regulation Article 28 allows data controllers to rely on legitimate interest, subject to the data subject's right to object, for profiling and direct-marketing purposes. #### Data PortabilityRed No explicit data-portability right was identified in the PDPL or Implementing Regulation text reviewed. #### Deadlines And Response WindowsRed No fixed statutory response-window (e.g., a GDPR-style 30-day deadline) for DSR responses was located in the sources reviewed; the Implementing Regulation instead emphasizes justification for rejection rather than timing. Claims (1): - Data-subject rights request (Art.3(1)(a) Implementing Regulation) — Controllers must act on a rights request within 30 days, extendable once by up to 30 further days with notice of reasons The PDPL provides a GDPR-style suite of data subject rights (access, correction, deletion, restriction, objection), but the Implementing Regulation gives less granular guidance on scope and timelines than GDPR; no explicit data-portability provision or fixed statutory response deadline was identified in the materials reviewed. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (6) - [IAPP](https://iapp.org/news/a/saudi-arabia-publishes-final-personal-data-protection-law) — The Implementing Regulation permits verbal data subject requests under an authentication mandate, which is regarded as an operational burden on controllers. - [IAPP](https://iapp.org/news/a/saudi-arabia-publishes-final-personal-data-protection-law) — There is no allowance under the Implementing Regulation for data controllers to charge data subjects for DSRs deemed excessive or repetitive, though controllers can reject such requests with justification. - [IAPP](https://iapp.org/news/a/saudi-arabia-publishes-final-personal-data-protection-law) — Implementing Regulation Article 28 allows data controllers to rely on legitimate interest, subject to the data subject's right to object, for profiling and direct-marketing purposes. - [DataSec](https://datasec.sa/en/compliance/pdpl) — Data-subject rights request (Art.3(1)(a) Implementing Regulation) — Controllers must act on a rights request within 30 days, extendable once by up to 30 further days with notice of reasons - [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/SDAIA/about/Documents/PersonalDataProtectionLaw.pdf) — Right to erasure (Art.4 PDPL) — Data subjects may request destruction of their personal data once no longer needed, without prejudice to Art.18 retention duties - [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPLCP/!ut/p/z1/04_Sj9CPykssy0xPLMnMz0vMAfIjo8ziPR1dzTwMgw2MDMOcTA3MjH39TE29jY0MQsz1w9EUhIZZAhUEGvl6OXoaGwQY60cRo98AB3A0IKTfi5ACoA-MinydfdP1owoSSzJ0M_PS8vUjAlwCfJwDgLZH4dVvYYyhANODYAV4fBCcWKRfkBsaUeWTFuyp66gIABC_KT0!/dz/d5/L0lHSkovd0RNQU5rQUVnQSEhLzROVkUvZW4!/) — Right to access and portability (Art.4(2),(3) PDPL) — Data subjects have a right to access their personal data and a right to obtain it in a readable, clear format ### Saudi Arabia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability infrastructure (DPIA, DPO, ROPA, breach notification) is binding and operative, but the immediate data-subject breach notification standard (rather than a risk-based threshold) is flagged by commentators as operationally stringent and under-specified. Primary framework PDPL (as amended) Arts. 20-23, Implementing Regulation (DPIA, breach, security provisions) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Core accountability infrastructure (DPIA, DPO, ROPA, breach notification) is binding and operative, but the immediate data-subject breach notification standard (rather than a risk-based threshold) is flagged by commentators as operationally stringent and under-specified. Periodic update · new data 2026-11-04 #### Controller/Processor Duties Two controller-facing obligations are under active revision through the same Implementing Regulation consultation. The first concerns breach notification: the current regime gates the duty to notify the regulator of a personal-data breach behind a harm-assessment threshold, and the draft amendment would remove that threshold, broadening the circumstances in which notification to the authority becomes mandatory. The underlying harm-assessment text that the draft would replace was not itself retrieved verbatim for this review, so the precise before-and-after wording cannot yet be set out side by side; the direction of the change, however, is clear from the draft and from legal commentary on it. The second concerns organisational duties: the draft revises the circumstances in which a controller must appoint a data protection officer, and introduces a mandatory National Register of Controllers obligation applying to public entities, to organisations whose core activity consists of data processing, to processing of sensitive data, and to any processing involving cross-border transfer or disclosure. Both elements remain proposals; neither is in force. #### Outlook If adopted as drafted, these changes would require affected controllers to review both their breach-response procedures and their registration and DPO-appointment status ahead of any effective date the authority eventually sets. The consultation closes 5 November 2026, and no adoption decision has been recorded as at the date of this note. Periodic update · new data 2026-10-25 #### Controller/Processor Duties The Implementing Regulations' Article 24 currently requires controllers to notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of a breach that may harm personal data or data subjects' rights, with no materiality self-assessment permitted under the current, in-force text. The draft amendments under consultation would preserve this no-threshold structure while being part of a broader package that also touches data protection officer administrative requirements and records-of-processing-activities obligations. On the administrative side, commentary describes a proposed requirement for organisations to input their data protection officer's contact details into the National Data Governance Platform, centralising what may currently be a more fragmented administrative process. Separately, simplified records-of-processing-activities requirements are proposed, clarifying that records must be retained for a defined period, which would give controllers clearer guidance on retention duration than may currently exist. Taken together, these two administrative changes point toward streamlining certain compliance-process burdens even as the substantive breach-notification duty remains strict and threshold-free. The absence of a materiality threshold for breach notification is a significant operational point for controllers and processors: any breach that may cause harm to personal data or to data subjects' rights triggers the 72-hour clock, regardless of the controller's own assessment of the breach's severity or likely impact. This places a premium on robust internal breach-detection and escalation processes capable of meeting a 72-hour notification window without the benefit of a materiality filter to exclude lower-risk incidents. #### Outlook Controllers and processors operating in Saudi Arabia should treat the no-threshold 72-hour breach-notification duty as a standing operational requirement that is not expected to loosen under the draft amendments. The proposed centralisation of data protection officer contact details into the National Data Governance Platform and the clarified records-of-processing-activities retention-period guidance are the two administrative changes to track for implementation once the amendments are finalised following the 5 November 2026 consultation close, as scheduled. D4 · Controller & Processor — Full Module Record 7 sub-modules · 41 words · 24 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer mechanisms are now GDPR-aligned in structure, but no specific adequacy decisions (received or granted) were identified in the reviewed sources, leaving practical cross-border flows dependent on SCCs/BCRs and TIAs. Primary framework Regulations on Personal Data Transfers 2023 (Cross-Border Data Transfer Regulation), PDPL Art. 28 (as amended) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Transfer mechanisms are now GDPR-aligned in structure, but no specific adequacy decisions (received or granted) were identified in the reviewed sources, leaving practical cross-border flows dependent on SCCs/BCRs and TIAs. Periodic update · new data 2026-11-04 #### Cross-Border & Adequacy The draft Implementing Regulation amendments under consultation would introduce, for the first time, an express requirement that personal data be stored within the Kingdom of Saudi Arabia. The same draft provision permits transfer or disclosure of data outside the Kingdom where the conditions set out in the Law and the Regulation are satisfied, so the proposal is framed as a localisation default paired with a conditional export permission rather than an outright prohibition on cross-border movement. This is a notable departure from the position reported previously, under which the Law did not require personal data to be stored or processed inside the Kingdom. The provision remains in draft; the consultation on it closes 5 November 2026 and the authority has not confirmed whether or in what form it will be adopted. #### Outlook Adoption of the localisation requirement, even subject to a transfer exception, would be the most significant change to the Kingdom's cross-border data regime since the Implementing Regulation first took effect. Organisations relying on offshore storage or processing arrangements involving data relating to the Kingdom have reason to watch the consultation outcome closely; the effective date, if the provision is adopted, is reported by secondary sources as 60 days after Gazette publication, though the regulator has not confirmed this timeline itself. Periodic update · new data 2026-10-25 #### Cross-Border & Adequacy The most significant proposed change in Saudi Arabia's current data protection reform package is a new draft Article 23(2), which would introduce a default requirement for controllers to store personal data within the Kingdom. Importantly, this default localisation requirement is paired with a continued permission for cross-border transfer or disclosure where the Personal Data Protection Law and its Implementing Regulations so provide, meaning the proposal does not amount to an absolute prohibition on cross-border data flows but rather shifts the default starting position from transfer-permitted to localisation-by-default, with transfer available as a provided-for exception rather than a general rule. This development sits within a jurisdiction whose data protection framework is not part of the European Union's regulatory architecture, and whose cross-border transfer rules are instead a matter of the Kingdom's own Personal Data Protection Law and its separate Transfer Regulation. The direction of this proposed change, toward a default localisation posture, is consistent with a broader regional and global pattern of jurisdictions tightening default expectations around where personal data is stored, even as specific mechanisms for permitted cross-border transfer are preserved alongside that default. For controllers and processors currently relying on cross-border data architecture, whether for group-level data processing, cloud infrastructure located outside the Kingdom, or cross-border service delivery, the practical significance of draft Article 23(2) is that any such architecture may need to be reassessed against a default localisation requirement once the amendments are finalised, with continued reliance on cross-border transfer dependent on qualifying under the Law and its Implementing Regulations. The consultation on this and the other draft amendments closes 5 November 2026, with the amendments, if approved, expected to take effect 60 days following publication in the official Gazette. #### Outlook Organisations with cross-border data architecture touching Saudi Arabia should treat the proposed default localisation requirement under draft Article 23(2) as the single most consequential item in this consultation cycle to monitor through to finalisation. Confirmation of which specific transfer mechanisms will qualify as provided-for exceptions under the finalised Law and Implementing Regulations will be the key detail to watch once the draft text moves toward adoption following the 5 November 2026 consultation close, as scheduled. Periodic update · new data 2026-10-18 #### Cross-Border & Adequacy SDAIA's draft amendments to the PDPL Implementing Regulations, published for consultation on 6 October 2026, list data localisation as the first Key Change among the proposed amendments, according to law-firm commentary on the consultation notice. The substantive operative text of the data-localisation provision, including its scope, the categories of data or processing activity it would apply to, and any thresholds or exemptions, has not yet been retrieved; the finding currently rests on the fact that data localisation appears first in SDAIA's own listing of Key Changes, as relayed by secondary commentary, rather than on the provision's actual drafted language. This is nonetheless a significant signal in its own right. The prominence given to data localisation within SDAIA's consultation framing suggests that cross-border data transfer arrangements, currently governed by whatever baseline cross-border transfer mechanism exists under the PDPL's current Implementing Regulations, may be materially tightened once the amendments are finalised. Entities that currently process Saudi Arabia residents' personal data outside the Kingdom, whether through cloud infrastructure, group-wide data processing arrangements, or outsourced processing relationships, would be the natural constituency affected by any data-localisation requirement, though until the operative text is available, the precise compliance burden cannot be assessed with confidence. The consultation period runs until 5 November 2026. If the amendments, including the data-localisation provision, are approved following that consultation, they would take effect sixty days after publication in the official Gazette, which would place a plausible effective date in the first quarter of 2027. This timeline gives affected entities a window, albeit currently an uncertain one given the unresolved substantive scope, to begin assessing their cross-border data architecture ahead of a possible early-2027 effective date. No other cross-border or adequacy-related development for Saudi Arabia was evidenced this cycle. The data-localisation Key Change stands as the sole, though materially significant, finding in this module, and its ultimate impact will depend heavily on the operative text that has not yet been published or retrieved. #### Outlook The most consequential open question for this module is the substantive content of the data-localisation provision itself, which is expected to become clearer either during the consultation period, which closes 5 November 2026, or upon publication of the finalised amendments in the Gazette. Entities with cross-border data architecture touching Saudi Arabia residents' personal data should monitor for the release of the operative text, which will determine the actual scope and compliance implications of the data-localisation Key Change. Until that text is available, any assessment of impact remains necessarily provisional. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 55 words · 18 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and health/credit sector overlays are well-documented and binding; employment, education, and insurance sector-specific DP rules were not located and are flagged as gaps. Primary framework PDPL Implementing Regulation Arts. 26-27; SAMA IT Governance/Cybersecurity Framework; NCA Essential Cybersecurity Controls Supervisory authority [Saudi Central Bank (SAMA)](https://www.sama.gov.sa/en-US/) Traffic-light rationale — Amber Financial and health/credit sector overlays are well-documented and binding; employment, education, and insurance sector-specific DP rules were not located and are flagged as gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 65 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing consent rules are binding and actively enforced; cookie/tracker, dark-pattern, opt-out-signal, and clean-room coverage are gaps in the current PDPL framework as researched. Primary framework PDPL Implementing Regulation Arts. 28-29 (direct marketing) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Direct-marketing consent rules are binding and actively enforced; cookie/tracker, dark-pattern, opt-out-signal, and clean-room coverage are gaps in the current PDPL framework as researched. Periodic update · new data 2026-11-04 #### AdTech & Commercial Privacy A further element of the same Implementing Regulation consultation would require consent before sending promotional or awareness-raising materials to any recipient, and would additionally require verification of consent where a controller instead relies on having an existing relationship with the recipient as its basis for sending such materials. This would extend the consent requirement beyond the narrower circumstances addressed under the current marketing provisions. The change is, again, a draft proposal open for comment until 5 November 2026 and is not yet in force. #### Outlook If adopted, the amendment would narrow the room controllers currently have to rely on an existing-relationship basis for sending marketing or awareness communications without separately verifying consent. Organisations running direct-marketing or customer-communication programmes touching the Kingdom should treat the consultation outcome as the next relevant marker, rather than the current text, which remains unchanged pending the authority's decision. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy Marketing conducted without documented consent is reported as the most frequently cited violation category among the Saudi Data and Artificial Intelligence Authority's confirmed 2025 enforcement decisions, with continuing 2026 enforcement actions penalising mass messaging campaigns across SMS, WhatsApp, and email channels that lack documented consent from recipients. This sustained enforcement focus indicates that commercial marketing practices remain a leading area of active supervisory attention under the Personal Data Protection Law. Against this enforcement backdrop, the draft amendments to the Implementing Regulations under consultation would make two changes relevant to commercial marketing practice. First, the standalone definition of direct marketing currently in the regulatory text would be removed, a structural drafting change requiring edits to all affected cross-references, while the underlying Article 11 consent requirement is reported to persist unchanged as the operative lawful basis for marketing activity. Second, a new requirement would be introduced obliging marketers to disclose the sender's identity when sending direct marketing material, adding a transparency obligation that sits alongside, rather than replacing, the existing consent requirement. Read together, the enforcement pattern and the proposed amendments describe a consistent regulatory posture: documented consent remains the central lawful basis for marketing activity, and the authority continues to actively penalise its absence, while the proposed sender-identification requirement would add a further, distinct transparency obligation on top of the consent requirement rather than substituting for it. Organisations conducting direct marketing into the Saudi market, whether by SMS, WhatsApp, email, or other channels, should treat documented consent and, pending finalisation of the proposed changes, sender identification as the two central compliance points in this area. #### Outlook Continued active enforcement against marketing conducted without documented consent is the clearest pattern to expect going forward, consistent with the volume and categories seen in the confirmed 2025 enforcement decisions. The proposed sender-identification requirement for direct marketing material is a new obligation to track through to finalisation following the 5 November 2026 consultation close, as scheduled, alongside the broader fate of the direct-marketing definition's removal from the regulatory text. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 44 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling-objection and genetic-data coverage are binding; AI risk-assessment instruments remain largely non-binding policy/guidance; biometric-specific rules and ADM transparency rights are gaps. Primary framework PDPL Implementing Regulation Art. 28; SDAIA AI Ethics Principles / draft Responsible AI Policy (non-binding guidance) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Profiling-objection and genetic-data coverage are binding; AI risk-assessment instruments remain largely non-binding policy/guidance; biometric-specific rules and ADM transparency rights are gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 69 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a general guardian/representative concept was located; no PDPL-specific child/vulnerable-group sub-regime (age thresholds, parental consent mechanics, minor profiling bans) was found despite targeted searches. Primary framework PDPL definitional provisions (data subject includes representative/legal guardian) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Red Only a general guardian/representative concept was located; no PDPL-specific child/vulnerable-group sub-regime (age thresholds, parental consent mechanics, minor profiling bans) was found despite targeted searches. D9 · Children's Privacy — Full Module Record 5 sub-modules · 41 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Saudi Arabia: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator powers and penalties are well-evidenced and enforcement activity is demonstrably rising, but private rights of action and collective redress mechanisms are not evidenced in the sources reviewed, and regulator funding/capacity data is absent. Primary framework PDPL Arts. on penalties; SDAIA committee enforcement structure; Licensing and Accreditation Rules (Feb 2026) Supervisory authority [Saudi Data and Artificial Intelligence Authority (SDAIA)](https://sdaia.gov.sa/en/) Traffic-light rationale — Amber Regulator powers and penalties are well-evidenced and enforcement activity is demonstrably rising, but private rights of action and collective redress mechanisms are not evidenced in the sources reviewed, and regulator funding/capacity data is absent. Periodic update · new data 2026-11-04 #### Enforcement & Redress No enforcement action, penalty decision or redress matter has been identified in the current window. The principal development bearing on this module is procedural rather than adjudicative: the Implementing Regulation consultation described elsewhere in this note would, if adopted, alter the breach-notification threshold that in turn affects when the regulator's enforcement machinery is engaged in the first place. No primary enforcement activity accompanies the consultation itself. #### Outlook Enforcement posture is likely to be shaped indirectly by the outcome of the Implementing Regulation consultation rather than by any pending case; a broadened breach-notification trigger, if adopted, would be expected to increase the volume of matters reaching the regulator's attention over time, though no such effect can yet be observed. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Saudi Data and Artificial Intelligence Authority's Committees for Reviewing Violations of the Personal Data Protection Law confirmed 48 decisions finding violations during 2025, an outcome announced 16 January 2026. The violation categories cited across these decisions include processing without a legal basis, unauthorised disclosure, inadequate safeguards, and marketing without consent, with marketing without consent reported as the most frequently cited category overall. This enforcement-volume figure provides a concrete benchmark for the scale of the authority's active supervisory activity during what is a relatively early period in the Personal Data Protection Law's operative life, the Law itself having taken effect in September 2023. The underlying penalty framework available to the authority's review committees, under Article 36 of the Personal Data Protection Law, allows for warnings or administrative fines of up to 5,000,000 Saudi riyals per violation, with that ceiling doubled for repeat violations. Separately, criminal liability under the Law can extend to imprisonment of up to two years alongside individual fines of up to 3,000,000 Saudi riyals for certain conduct, indicating that the Saudi enforcement regime carries both administrative and criminal dimensions depending on the nature and severity of the violation. The scale of these penalty ceilings, combined with the confirmed 2025 enforcement volume of 48 decisions, signals an active and consequential enforcement posture rather than a largely dormant penalty framework. The pattern of cited violation categories, processing without a legal basis, unauthorised disclosure, inadequate safeguards, and marketing without consent, maps closely onto the core substantive obligations of the Personal Data Protection Law and its Implementing Regulations, suggesting that the authority's enforcement activity to date has concentrated on foundational compliance failures rather than more novel or technical areas of the Law. #### Outlook Continued enforcement activity at a comparable or increased volume to the 48 decisions confirmed for 2025 is the expected pattern for 2026, particularly given the authority's stated active focus on marketing-without-consent violations. Whether the draft amendments currently under consultation, if finalised, introduce any new enforcement priorities or penalty adjustments tied to the proposed localisation, breach-notification, or marketing provisions is a further point to watch once the amendments are finalised following the 5 November 2026 consultation close, as scheduled. Periodic update · new data 2026-10-18 #### Enforcement & Redress SDAIA confirmed, in a statement carried by the Saudi Press Agency on 16 January 2026, that its Committees for Reviewing Violations had issued 48 enforcement decisions under PDPL Article 36 over the preceding year. The amounts of individual decisions were not disclosed by SDAIA, limiting the ability to assess the scale or typical severity of penalties actually imposed, though the confirmed decision count itself indicates that the PDPL's enforcement machinery is operating with meaningful activity volume rather than remaining dormant following the law's implementation. The available penalty framework, per Tier 3 commentary on PDPL Article 36, permits SDAIA's Committees for Reviewing Violations to issue warnings or administrative fines of up to SAR 5,000,000 per violation, doubled for repeat violations. Separately, unauthorised disclosure of sensitive data intended to cause harm carries a criminal penalty of up to two years' imprisonment and/or a fine of up to SAR 3,000,000. This combination of administrative and criminal exposure under a single statutory article gives Saudi Arabia's data protection enforcement regime a notably broader penalty range than a purely administrative-fine model, extending potential consequences for the most serious conduct, intentional harmful disclosure of sensitive data, into the criminal sphere. Data subjects are understood to hold a right to claim compensation before the competent court for material or moral damage suffered as a result of a PDPL violation, according to secondary legal commentary; the pinpoint statutory article establishing this private right of action has not been independently retrieved this cycle. This private right of action exists alongside, rather than instead of, SDAIA's own administrative enforcement powers, giving affected data subjects a parallel avenue for redress distinct from any regulatory penalty SDAIA itself might impose on a controller or processor. The confirmation of 48 decisions in the preceding year, read together with the available penalty ceiling of SAR 5,000,000 per violation, suggests an enforcement posture of active and recurring application rather than occasional or symbolic use of SDAIA's powers. However, because individual decision amounts remain undisclosed, it is not possible from the material available this cycle to assess what proportion of the 48 decisions approached the statutory maximum, nor to characterise the typical profile of a PDPL enforcement action under Article 36. #### Outlook The confirmed enforcement volume of 48 decisions over the preceding year establishes a baseline against which future enforcement-activity disclosures from SDAIA can be compared. Should SDAIA begin publishing individual decision amounts or further detail on the nature of violations underlying these decisions, future assessments of the PDPL enforcement regime's practical severity and targeting would be considerably strengthened. The interaction between this active enforcement posture and the pending PDPL Implementing Regulation amendments, including the data-localisation Key Change under consultation until 5 November 2026, is also worth monitoring, as any newly created obligations under the amended regulations would become a fresh basis for future Article 36 enforcement activity once in force. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 79 words · 20 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties