Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)

Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)

Type	Implementing Regulation
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Implementing & executive regulation
Legal status	Withdrawn or overtaken
Instrument number	SDAIA
Version	Consultation draft, April 2025
Dates	Withdrawn. Consultation closed 27 May 2025; not enacted; overtaken by the October 2026 draft.
Last verified	2026-10-20

SDAIA consulted on draft amendments to the Implementing Regulation (IR) of the PDPL on Istitlaa from 27 April to 27 May 2025. Not enacted; overtaken by the October 2026 draft.

What it proposed:

• folding the DPO Appointment Rules into IR Art 32 and the Register Rules into IR Art 34, with registration required for transfers relying on Transfer Regulation Art 4;
• simplifying the records-of-processing requirement (Art 33);
• a privacy policy in clear, simplified language (new Art 18 (Repeated));
• tightening Art 28: consent for advertising and awareness material without the prior-interaction carve-out;
• removing the 90-day complaint window (Art 37);
• 10 business days to answer SDAIA requests (new Art 36 (Repeated));
• entry into force on Gazette publication (Art 38).

Draft text (2025 consultation, English).

Documents

• Hosted official text (PDF, English)
• Official source (istitlaa.ncc.gov.sa)

Updates for this instrument

• 2025-05-27 · Third public consultation on Implementing Regulation amendments: SDAIA's public consultation (27 April to 27 May 2025) proposed amendments to the Implementing Regulation: folding the DPO-appointment and controller-registration rules into it, simplifying the RoPA requirement, adding a

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Rules for Appointing a Personal Data Protection Officer
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
• Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations
• Draft standards guides for PDPL certification and audit providers
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21