Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)

National authority for data & AI; the PDPL regulator and — via the NDMO — government data governance.

SDAIA is Saudi Arabia's national authority for data and AI and the PDPL regulator. The NDMO (National Data Management Office) sits within SDAIA and governs government data management: 77 controls / 191 specifications, mandatory for government entities. The NDI (National Data Index) measures across three lenses — Maturity, Compliance and Operational Excellence.

Regulates: All Data Controllers (PDPL) · All Data Processors (PDPL) · Government Entities (NDMO) · Government Data Partners (NDMO)

Protects: Data Subjects (all) · Personal Data Rights · Sensitive Data · Cross-border Transfers

Official website

Instruments issued or administered (37)

Personal Data Protection Law (PDPL) — Law
SDAIA Organizational Arrangements — Council of Ministers Resolution
Implementing (Executive) Regulation — Implementing Regulation
NDMO Data Management & Personal Data Protection Standards — Standard
Regulation on Personal Data Transfer Outside KSA — Implementing Regulation
Freedom of Information Policy — Regulation
Data Classification Policy — Standard
Open Data Policy — Regulation
Rules for Appointing a DPO — Rule
National Data Index (NDI) — Framework
Rules Governing the National Register of Controllers — Rule
AI Adoption Framework — Framework
Standard Contractual Clauses (SCCs) — Instrument
NDI — Operational Excellence (OE) — Instrument
Binding Common Rules (BCRs) — Instrument
Rules for Secondary Use of Data — Rule
NDI — Operational Excellence FAQs — Instrument
Rules for Auditing & Inspecting Controllers and Processors — Rule
Rules Governing Issuance of Accreditation Certificates — Rule
Committee Working Rules — Rule
National Occupational Standard Framework for Data & AI — Standard
Data Monetisation Policy — Guideline
Saudi Academic Framework for AI Qualifications — Instrument
Data Sharing Guideline — Guideline
AI Ethics Principles — Guideline
Privacy Policy (Notice) Guideline — Guideline
Destruction / Anonymisation / Pseudonymisation Guideline — Guideline
Generative AI Guidelines — Government & Public — Guideline
Personal Data Disclosure Guideline — Guideline
Deepfakes Guidelines — Guideline
Records of Processing (RoPA) Guideline — Guideline
Generative AI Guidelines — Public — Guideline
Personal Data Breach Incidents Procedural Guide — Guideline
Transfer to Non-Adequate Country Guideline — Guideline
Self-Assessment Guideline (incl. DPO-need tool) — Guideline
Minimum Personal Data Guideline — Guideline
Guide to the PDPL for Controllers and Processors — Guideline

Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27