Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)

National authority for data & AI; the PDPL regulator and, via the NDMO, government data governance.

SDAIA is Saudi Arabia's national authority for data and AI and the PDPL regulator. The National Data Management Office (NDMO) sits within SDAIA and governs government data: the NDMO Standards (77 controls, 191 specifications) and the National Data Governance policies, mandatory for government entities. The National Data Index (NDI) measures entities on Maturity, Compliance and Operational Excellence.

PDPL instruments include the Implementing Regulation (IR), the Transfer Regulation, the Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities (v1.0, 2026), and the non-binding Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (February 2025).
AI documents (AI Ethics Principles, generative AI and deepfakes guidelines, adoption and risk management frameworks) are issued by SDAIA itself. NDMO issues the data management instruments.
Data Regulatory Sandbox: the personal data protection track opened for registration on 6 October 2026 for two months, for licensed private entities in the Kingdom that process personal data and are registered in the National Register of Controllers.

Open consultations (as at 20 October 2026): draft amendments to the PDPL Implementing Regulation, published on Istitlaa on 6 October 2026; comments close 5 November 2026. The draft would repeal the DPO Appointment Rules and the Register Rules.

Regulates: All Data Controllers (PDPL) · All Data Processors (PDPL) · Government Entities (NDMO) · Government Data Partners (NDMO)

Protects: Data Subjects (all) · Personal Data Rights · Sensitive Data · Cross-border Transfers

Official website

Instruments issued or administered (49)

Personal Data Protection Law (PDPL) · Law
SDAIA Organizational Arrangements · Council of Ministers Resolution
ICAIRE Basic Statute · Royal Decree
Data Sharing Policy · Instrument
Implementing Regulation of the Personal Data Protection Law · Implementing Regulation
Draft Amendments to the Implementing Regulation of the PDPL (October 2026) · Implementing Regulation
Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025) · Implementing Regulation
NDMO Data Management & Personal Data Protection Standards · Standard
Freedom of Information Policy · Instrument
Regulation on Personal Data Transfer Outside KSA · Implementing Regulation
National Data Governance Interim Regulations · Instrument
Responsible AI Policy (draft) · Instrument
Data Classification Policy · Instrument
Open Data Policy · Instrument
Data Monetization Policy · Instrument
Rules Governing the National Register of Controllers within the Kingdom · Rule
AI Adoption Framework · Framework
Draft Requirements for Practising Personal Data Protection Activities (April 2025) · Rule
Rules for Appointing a Personal Data Protection Officer · Rule
National Data Index (NDI) · Framework
NDI: Operational Excellence (OE) · Instrument
Standard Contractual Clauses (SCCs) · Instrument
Guidelines for Binding Common Rules (BCR) for Personal Data Transfer · Instrument
General Rules for Secondary Use of Data · Rule
NDI: Operational Excellence FAQs · Instrument
National AI Risk Management Framework · Framework
Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors · Rule
Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities · Rule
Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations · Rule
National Occupational Standard Framework for Data & AI · Standard
Data and AI Capability Frameworks (2026) · Framework
Saudi Academic Framework for AI Qualifications · Instrument
AI Ethics Principles · Guideline
Draft standards guides for PDPL certification and audit providers · Guideline
Privacy Policy (Notice) Guideline · Guideline
Destruction, Anonymisation and Pseudonymisation Guideline · Guideline
Generative AI Guidelines for Government · Guideline
Personal Data Disclosure Cases Guideline · Guideline
Deepfakes Guidelines · Guideline
Records of Processing (RoPA) Guideline · Guideline
Generative AI Guidelines: Public · Guideline
Personal Data Breach Incidents Procedural Guide · Guideline
Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom · Guideline
Self-Assessment Guideline (incl. DPO-need tool) · Guideline
Minimum Personal Data Determination Guideline · Guideline
Guide to the PDPL for Controllers and Processors · Guideline
Data Regulatory Sandbox · Instrument
AI Principles in Media · Guideline
Year of AI 2026 Guidelines · Guideline

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21