Wadira: Find your way through Saudi data & privacy law.
Saudi Arabia's data, cybersecurity & governance regime, mapped
Wadira is an independent, source-backed reference for Saudi Arabia's regulatory regime for data and cyber: the Personal Data Protection Law (PDPL) and its regulations, NCA cybersecurity controls (ECC/CCC), and the SAMA, CMA, CST and MOH frameworks, with the official texts hosted (in English, and in Arabic where available; the Arabic text is authoritative).
Constitutional foundation: The Basic Law of Governance and Sharia, plus the general laws that touch personal data: electronic transactions, e-commerce, evidence, civil
Personal Data Protection (PDPL): Saudi Arabia's data-protection regime: the PDPL, its Implementing Regulation, and the rules and guidelines beneath them.
Data Management & Governance: Saudi Arabia's national data management and governance regime: the NDMO Standards, the National Data Governance policies (classification, sh
Cybersecurity: The Anti-Cyber Crime Law and the National Cybersecurity Authority's controls and frameworks (ECC, CCC and more).
Financial services: Saudi Central Bank (SAMA) and Capital Market Authority (CMA) laws, frameworks and rules for banks, finance and payment companies, credit bur
Artificial Intelligence: AI laws, policies and guidelines (SDAIA, CST, NCA). The only law is CST's draft Global AI Hub Law. Personal data in AI systems is governed b
Telecommunications & ICT: CST's telecom and ICT regime: the Telecommunications and IT Act and its Implementing Regulations, CST's Organisation, licensing, the CRF, an
Cloud & Data Centres: CST's cloud and data centre regime: the Cloud Computing Services Provisioning Regulations v4, cloud provider classes and guides, the Data Ce
Health data: Health data rules and standards from the Ministry of Health, the Saudi Health Council and NHIC, the SFDA and the National Committee of Bioet
National Cybersecurity Authority (NCA): National cybersecurity regulator: issues and enforces controls (ECC, CCC and related sets) for government entities and C
Saudi Central Bank (SAMA): Central bank; supervises banks, finance companies, payment providers and credit bureaus. Its Cyber Security Framework is
Capital Market Authority (CMA): Capital market regulator; regulates listed issuers and 215 Capital Market Institutions. Its cybersecurity Main Controls
Insurance Authority (IA): Insurance regulator; supervises insurers and insurance service providers, a role previously held by SAMA.
Ministry of Health (MOH): Health ministry; health data is PDPL sensitive data. This page also lists NHIC, Saudi Health Council, SFDA and research
Recent regulatory changes
2026-10-08 · Controller registration reported open to organisations outside the Kingdom
2026-10-06 · Data Regulatory Sandbox: personal data protection track opens
2026-10-06 · SDAIA consults on revised draft amendments to the PDPL Implementing Regulation
2026-10-02 · NCA reaffirms mandatory registration of cybersecurity providers through Haseen