In force (September 2023 text). SDAIA published revised draft amendments on Istitlaa on 6 October 2026; comments close 5 November 2026. The April–May 2025 draft was not enacted. If adopted, the amendments take effect 60 days after Gazette publication.
Last verified
2026-10-20
The Implementing Regulation (IR) of the PDPL (September 2023) gives the Law its operational detail across 38 articles. It is in force. SDAIA published revised draft amendments on Istitlaa on 6 October 2026; comments close 5 November 2026. The April–May 2025 draft was not enacted. The provisions below are the text in force as at 20 October 2026.
What it covers.
Data-subject requests: answer within 30 days, extendable by a further 30 (Art 3).
Consent: freely given, purpose-specific, documented and separate per purpose; explicit for sensitive data, credit data and solely automated decisions (Art 11). Withdrawal must be as easy as consenting (Art 12).
Legitimate interest: a documented prior assessment; not available to public entities or for sensitive data (Art 16).
Processors: contracts covering purpose, data categories, breach notification and subcontracting (Art 17).
Security: National Cybersecurity Authority (NCA) controls, or recognised best practice where those are not mandatory (Art 23).
Breach: notify SDAIA within 72 hours where the incident potentially causes harm to the personal data or the data subject, or conflicts with their rights or interests (Art 24(1)). That is a low, harm-based threshold, but a threshold; PDPL Art 20(1) itself has none. Data subjects are notified without undue delay where damage results.
Impact assessments (Art 25): (a) sensitive data; (b) collecting, comparing or linking two or more datasets; (c) large-scale or repetitive processing of data of persons lacking capacity, constant monitoring, new technologies or automated decision-making; (d) products or services likely to cause serious harm to privacy.
Sector data: health data (Art 26) and credit data (Art 27).
Marketing: consent before sending advertising or awareness material "in case of the absence of a prior interaction" (Art 28(1)); consent before processing for direct marketing; free, easy and immediate opt-out; sender identity disclosed (Arts 28–29).
DPO, records, register: a data protection officer in the cases of Art 32; records of processing for the duration of processing plus five years (Art 33); registration on the national register under SDAIA's rules (Art 34).
Complaints: to SDAIA within 90 days (Art 37).
Proposed (October 2026 draft)
If adopted, the amendments take effect 60 days after Official Gazette publication (draft Art 38). Both the 2025 and October 2026 drafts tighten Art 28: they delete the words that limited the consent requirement to cases with no prior interaction, aligning the Regulation with PDPL Art 25.
Art 1: adds "and its amendments"; defines the Competent Authority's Platform; deletes the "Direct Marketing" and "Personal Data Breach" definitions.
Art 3: extension only for unexpected or unusual effort or multiple requests; an unanswered request is deemed rejected; refusal only if repeated without justification or requiring unusual effort; new complaint route to SDAIA (Art 3(4)).
Art 11: explicit consent for solely automated decisions only where they affect data subjects' rights or interests.
Art 18 (Repeated): privacy policy in clear, simplified language consistent with the language customarily used for the service.
Art 23: new Art 23(2): "The Controller shall store Personal Data within the Kingdom." Transfers and disclosures abroad remain permitted under the Law and Regulations.
Art 24: notify SDAIA within 72 hours of any breach, damage or unauthorised access; the harm test remains only for notifying data subjects.
Art 25: triggers recast (sensitive data or data of minors or persons lacking capacity; linking datasets; large scale or regular and systematic monitoring; any emerging technology; solely automated decisions affecting rights or interests); "serious harm" catch-all deleted.
Art 28: consent for all promotional or awareness messages; where a prior relationship exists, consent must be verified.
Art 29: on withdrawal of consent to marketing, stop and destroy the resulting data.
Art 32: new DPO triggers; DPO details filed on the platform; DPO Appointment Rules repealed.
Art 33: content list, "written" requirement and SDAIA templates deleted; retention for processing plus five years kept.
Art 34: mandatory registration triggers set in the IR, including any transfer or disclosure outside the Kingdom; Register Rules repealed.
Art 35: deleted (licensing of accreditation bodies, now covered by the 2026 licensing rules).
Art 36: audit and inspection under the 2026 licensing and audit rules; new Art 36 (Repeated): 20 business days to answer SDAIA requests.
Art 37: 90-day complaint window removed.
Art 38: in force 60 days after Gazette publication.
The Arabic text controls. This summary is checked against the English consultation text dated 6 October 2026.
History. The April–May 2025 draft (consultation closed 27 May 2025) proposed folding the DPO and Register Rules into the IR, simplifying records of processing, tightening Art 28, removing the 90-day complaint window and a 10-business-day deadline to answer SDAIA. It was not enacted and is overtaken by the October 2026 draft. Draft text (2025 consultation).
Frequently asked questions
When must a data breach be notified in Saudi Arabia?
Under Art 24(1), within 72 hours of becoming aware of an incident that potentially causes harm to the personal data or the data subject, or conflicts with their rights or interests. The threshold is low but it exists. Data subjects are notified without undue delay where the breach may cause them damage. The October 2026 draft would remove the harm test for notifying SDAIA.
Who must appoint a data protection officer (DPO)?
Art 32 requires a DPO where the controller is a public entity providing services involving large-scale processing, where core activities involve regular and systematic monitoring of data subjects, or where core activities consist of processing sensitive data. The DPO may be an employee or an external provider.
What triggers a data protection impact assessment?
Art 25 lists the mandatory cases: (a) processing sensitive data; (b) collecting, comparing or linking two or more datasets; (c) large-scale or repetitive processing of data of persons lacking capacity, constant monitoring, new technologies or automated decision-making; (d) products or services likely to cause serious harm to privacy.
Have the amendments been enacted?
As at 20 October 2026, no amendment has been enacted. The live proposal is the October 2026 draft (comments close 5 November 2026). The September 2023 text remains in force.
Key provisions
Art. 4: Right to be informed. The data subject's right to be informed, and the transparency / privacy-notice obligation at or before collection (IR Arts. 3-8 set out the data-subject rights).
Art. 24: Personal Data Breach Notification. The Controller must notify SDAIA within 72 hours of becoming aware of an incident that potentially causes harm to the personal data or the data subject, or conflicts with their rights or interests (a low, harm-based threshold; PDPL Art 20(1) has none). Affected data subjects are notified without undue delay where damage results. Proposed (October 2026 draft): notify SDAIA of any breach, damage or unauthorised access; the harm test remains only for notifying data subjects.
Art. 1: Definitions. Adopts the definitions of Article 1 of the Personal Data Protection Law and defines additional terms used in the Regulation, including Direct Marketing, Personal Data Breach, Vital Interest, Actual Interest, Legitimate Interest, Pseudonymisation, Anonymization, and Explicit Consent. Proposed (October 2026 draft): adds "and its amendments"; defines the Competent Authority's Platform; deletes the Direct Marketing and Personal Data Breach definitions.
Art. 2: Personal or Family Use. Excludes from the Law's scope an individual's Processing of Personal Data for purposes not exceeding personal or family use, defined as Processing within a family or limited social circle. Publishing data to the public, disclosure beyond that circle, or professional, commercial, or non-profit use is not covered.
Art. 25: Data Protection Impact Assessment. An impact assessment is mandatory for: (a) sensitive data; (b) collecting, comparing or linking two or more datasets; (c) large-scale or repetitive processing of data of persons lacking capacity, constant monitoring, new technologies or automated decision-making; (d) products or services likely to cause serious harm to privacy. Proposed (October 2026 draft): triggers recast (sensitive data or data of minors or persons lacking capacity; linking datasets; large scale or regular and systematic monitoring; any emerging technology; solely automated decisions affecting rights or interests); the serious-harm catch-all and parts of the content list are deleted.
Art. 3: General Provisions for Data Subject Rights. Requires the Controller to act on data subject rights requests within 30 days, extendable by a further 30 days with notice, verify the requester's identity, and document all requests. Repetitive, manifestly unfounded, or disproportionate requests may be refused with reasons; legal guardians exercise rights for those lacking capacity. Proposed (October 2026 draft): extension only for unexpected or unusual effort or multiple requests; an unanswered request is deemed rejected; refusal only if repeated without justification or requiring unusual effort; new complaint route to SDAIA.
Art. 32: Data Protection Officer. Lists the processing that requires appointing a DPO (public bodies processing at scale, regular and systematic monitoring, core processing of sensitive data); the appointment is documented and notified to SDAIA. Proposed (October 2026 draft): DPO required for public entities providing services involving personal data (no large-scale test), regular and systematic monitoring on a large scale, or core sensitive-data processing; DPO details filed on the platform; the DPO Appointment Rules are repealed.
Art. 33: Records of Processing Activities (RoPA). The Controller maintains a written record of processing activities during processing and for five years afterwards, kept accurate and produced to SDAIA on request. Proposed (October 2026 draft): the content list, the "written" requirement and SDAIA templates are deleted; retention for processing plus five years and access on request are kept.
Art. 34: National Register of Controllers. Sets the requirements for registering controllers in the national register, distinct from the RoPA in Art. 33. Proposed (October 2026 draft): mandatory registration for public entities, controllers whose core activity requires processing, sensitive data or data of persons lacking capacity, any transfer or disclosure outside the Kingdom, and individuals beyond personal use; a per-controller register holds the PDPL Art 31 records; the Register Rules are repealed.
Art. 5: Right of Access. Grants the data subject the right to access their Personal Data held by the Controller, either on request or through a direct-access channel, provided access does not adversely affect others' rights such as intellectual property or trade secrets, and no Personal Data identifying another individual is disclosed.
Art. 36: Auditing and Controlling. Audits and checks of personal-data processing to ensure the entity properly protects personal data. (This, not Art. 24/25/33, is the audit obligation.) Proposed (October 2026 draft): audit and inspection under the 2026 licensing and audit rules; a new Art 36 (Repeated) sets 20 business days to answer SDAIA requests, extendable at SDAIA's discretion.
Art. 6: Right to Request Data Copy. Entitles the data subject to request a copy of their Personal Data in a readable and clear format, provided in a commonly used electronic format or, if feasible, a printed hard copy, without adversely affecting others' rights or disclosing Personal Data that identifies another individual.
Art. 7: Right to Request Correction. Allows the data subject to obtain restriction of Processing while the accuracy of contested Personal Data is verified. The Controller may request supporting documents, which must be destroyed once verification is complete, and must notify parties to whom the data was previously disclosed after correction, without undue delay.
Art. 8: Right to Request Destruction. Obliges the Controller to destroy Personal Data upon the data subject's request, when no longer necessary for the collection purpose, on withdrawal of consent where consent is the sole legal basis, or if processed unlawfully. All copies including backups must be destroyed and recipients notified, subject to Article 18 of the Law.
Art. 9: Anonymisation. Sets conditions for anonymising Personal Data: the Controller must ensure re-identification is impossible, assess the impact and re-identification risk, apply and update organisational, administrative, and technical measures in light of technological developments, and evaluate the effectiveness of the techniques used. Anonymised data is no longer considered Personal Data.
Art. 10: Means of Communication. Requires the Controller to provide appropriate means for handling data subject rights requests. The data subject may choose among the options made available, including e-mail, text messages, the national address, electronic applications, or any other lawful communication means provided by the Controller for this purpose.
Art. 11: Consent Conditions. Sets conditions for valid consent: freely given without misleading methods, for clear and specific purposes explained in advance, given by a person with full legal capacity, documented verifiably, and obtained separately for each Processing purpose. Explicit consent is required for Sensitive Data, Credit Data, and solely automated decision-making. Proposed (October 2026 draft): explicit consent for solely automated decisions only where they affect data subjects' rights or interests.
Art. 12: Consent Withdrawal. Confirms the data subject may withdraw consent at any time. Withdrawal must be as easy as giving consent, with procedures established in advance. The Controller must then cease Processing without undue delay and notify recipients to destroy the data; prior Processing and Processing on other legal bases remain unaffected.
Art. 13: Legal Guardian. Regulates how the legal guardian of a data subject lacking full or partial legal capacity exercises rights and consents to Processing in the subject's best interests. The Controller must verify guardianship validity, ensure the guardian's consent causes no harm, and let the data subject exercise rights upon reaching legal capacity.
Art. 14: Processing for Actual Interest. When Processing Personal Data to serve the data subject's Actual Interest, the Controller must retain evidence demonstrating both that the actual interest exists and that it is not possible to contact or communicate with the data subject.
Art. 15: Collecting Data from Third Parties. Governs Processing of Personal Data collected from sources other than the data subject: Processing must be necessary, proportionate to the purpose, and must not affect the data subject's rights and interests. Collection from publicly available sources must be lawful, and the Regulation's anonymisation provisions apply where relevant.
Art. 16: Processing for Legitimate Interest. Permits Controllers other than Public Entities to process Personal Data for a Legitimate Interest, provided the purpose is lawful, interests are balanced against the data subject's rights, no Sensitive Data is involved, and Processing is within reasonable expectations. A documented prior assessment is required, with modification if harm is indicated.
Art. 17: Processor Selection. Requires the Controller to select Processors offering sufficient guarantees and to conclude agreements covering purpose, data categories, duration, breach notification, and subcontractors. The Controller must issue instructions and periodically assess compliance; a Processor breaching instructions is treated as a Controller, and subcontracting requires guarantees and the Controller's prior acceptance.
Art. 18: Processing Beyond Original Purpose. Applies when Personal Data is processed for a purpose other than the one for which it was collected: the Controller must clearly define the new purposes, record them in Processing activity records, document data-scoping procedures such as data maps, and limit Processing to the minimum data necessary. Proposed (October 2026 draft): a new Art 18 (Repeated) requires a privacy policy in clear, simplified language consistent with the language customarily used for the service.
Art. 19: Data Minimisation. Requires the Controller to collect only the minimum Personal Data necessary to achieve the Processing purpose, using appropriate means such as data maps to link each collected item to a purpose, to avoid collecting unnecessary data, and to retain only the minimal data needed for the purpose. Proposed (October 2026 draft): the retain-minimum duty and the data-maps reference are deleted.
Art. 20: Disclosure of Personal Data. Sets controls for disclosing Personal Data, including data from publicly available sources: disclosure must relate to a specific, clear purpose, protect privacy, and be limited to the minimum necessary. Disclosure requests from public authorities must be documented, third-party data safeguarded through balancing and pseudonymisation, and all disclosure operations recorded with dates, methods, and purposes.
Art. 21: Public Interest Processing Controls. Applies when a Public Entity collects Personal Data indirectly, processes it for a new purpose, or requests disclosure to achieve a public interest. The entity must ensure necessity for a clearly defined public interest within its mandate, limit potential damage, record the operations, and process only the minimum data.
Art. 22: Correction of Personal Data. Details the Controller's correction duties: correcting inaccurate data, completing incomplete data, and updating outdated data. The Controller must verify accuracy, notify prior recipients and the data subject, document updates, suspend Processing where inaccurate data may cause harm, and maintain policies and periodic reviews of data accuracy.
Art. 23: Information Security. Requires the Controller to take organisational, administrative, and technical measures to secure Personal Data and protect privacy, including security measures limiting breach risks and adopting the controls, standards, and rules of the National Cybersecurity Authority, or recognised cybersecurity best practices where those rules are not mandatory for the Controller. Proposed (October 2026 draft): NCA controls where applicable, otherwise recognised standards and best practice; new Art 23(2): "The Controller shall store Personal Data within the Kingdom", with transfers abroad still permitted under the Law and Regulations.
Art. 26: Processing Health Data. Obliges the Controller to protect Health Data through organisational, technical, and administrative measures, adopting requirements of health and insurance regulators, embedding the Law in internal policies, segregating staff responsibilities with tiered access, documenting all Processing stages, binding Processors contractually, and limiting Processing to the minimum needed for healthcare or health insurance.
Art. 27: Processing Credit Data. Requires the Controller, without prejudice to the Credit Information Law, to protect Credit Data from unauthorised use, access, or disclosure by adopting requirements of the Saudi Central Bank and relevant authorities, and to obtain the data subject's consent and notify them of any request to disclose their Credit Data.
Art. 28: Advertising and Awareness Materials. Regulates sending advertising or awareness materials: prior consent of the targeted recipient is required absent previous interaction, consent must be free, specific, and documented, the sender's identity must be clearly stated, and recipients must be able to halt such materials easily, immediately, and free of charge. Proposed (October 2026 draft): consent for all promotional or awareness messages (the prior-interaction carve-out is deleted); consent must be verified where a prior relationship exists; the Telecommunications and IT Act reference is removed.
Art. 29: Direct Marketing. Requires the Controller, before Processing Personal Data for Direct Marketing, to obtain the data subject's consent and provide a mechanism to halt marketing material that is as simple as giving consent. The sender's identity must be clearly disclosed, and marketing must stop without undue delay upon consent withdrawal. Proposed (October 2026 draft): applies to processing for marketing purposes; on withdrawal, the controller must stop and destroy the resulting data.
Art. 30: Scientific, Research or Statistical Purposes. Governs collecting or Processing Personal Data for scientific, research, or statistical purposes without the data subject's consent: purposes must be clearly specified in Processing records, only the minimum necessary data collected, data pseudonymised where the purposes can still be fulfilled, and any negative impact on the data subject's rights avoided.
Art. 31: Photographing or Copying Official Documents. Prohibits the Controller from photographing or copying official documents issued by Public Entities that identify data subjects, except at the request of a public competent authority or to fulfil a legal requirement. Such documents must be protected and destroyed once their purpose ends, unless retention is legally required.
Art. 35: Accreditation Bodies. Tasks the competent authority with issuing regulatory rules for licensing entities that grant accreditation certificates to Controllers and Processors under Article 33 of the Law, and with coordinating with the Digital Government Authority on licensing entities that provide such services on behalf of government entities. Proposed (October 2026 draft): deleted; licensing of accreditation bodies is covered by the 2026 licensing rules.
Art. 37: Submitting and Processing Complaints. Allows a data subject to file a complaint with the competent authority within 90 days of the incident or of becoming aware of it, with late complaints admissible for reasonable causes. The authority must register, examine, and act on complaints and inform the complainant of the outcome. Proposed (October 2026 draft): the 90-day complaint window is removed; complainants give more detail; SDAIA may disclose complaint data (minimum necessary).
Art. 38: Publication and Enforcement. Provides that the Regulation shall be published in the official gazette and on the competent authority's official website, and shall come into force from the date of the Law's enforcement. Proposed (October 2026 draft): in force 60 days after Official Gazette publication.