Rules Governing the National Register of Controllers within the Kingdom

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Rules, controls & standards
Legal status	In force, proposed for repeal
Dates	In force; proposed for repeal (October 2026 draft).
Last verified	2026-10-20

In force; registration on the National Data Governance Platform.

Who must register (Art 2): in-Kingdom controllers that are public entities, whose main activity involves processing personal data, or that process sensitive data; and individuals processing beyond personal or family use.
Certificates: valid up to 5 years.
Overseas controllers: the Rules say separate rules will follow.
Proposed: the October 2026 draft would repeal these Rules and set the triggers in Implementing Regulation Art 34. It adds data of persons lacking capacity and any transfer or disclosure outside the Kingdom, and creates a per-controller register on the platform holding the PDPL Art 31 records.

Overseas controllers (reported, not confirmed). A law-firm note of 8 October 2026 reports that SDAIA opened controller registration to organisations outside the Kingdom, through an authorised representative and Ministry of Foreign Affairs digital-identity verification, on the basis of PDPL Arts 2 and 33(4). The primary announcement has not been located, and whether registration is mandatory for overseas controllers is not confirmed.

Documents

Updates for this instrument

2026-10-08 · Controller registration reported open to organisations outside the Kingdom: A law-firm note of 8 October 2026 reports that SDAIA opened controller registration to organisations outside the Kingdom, through an authorised representative and Ministry of Foreign Affairs digital-identity verification

In this framework

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21