Wadira: Find your way through Saudi data & privacy law.
Home › Frameworks › Personal Data Protection (PDPL) › Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
| Type | Implementing Regulation |
|---|---|
| Issuing authority | Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO) |
| Framework | Personal Data Protection (PDPL) |
| Tier | Implementing & executive regulation |
| Legal status | Draft, consultation open |
| Instrument number | SDAIA |
| Issued | 2026-10-06 |
| Version | Consultation draft, 6 October 2026 |
| Dates | Draft. Published on Istitlaa 6 October 2026; comments close 5 November 2026. In force 60 days after Gazette publication if adopted. |
| Last verified | 2026-10-20 |
SDAIA published revised draft amendments to the Implementing Regulation (IR) of the PDPL on Istitlaa on 6 October 2026. Comments close 5 November 2026. If adopted, the amendments take effect 60 days after Official Gazette publication (draft Art 38). This is the second revised draft; the April–May 2025 draft was never enacted. Status as at 20 October 2026: open for comment.
| Draft art | Proposed change |
|---|---|
| 1 | Adds "and its amendments"; defines the Competent Authority's Platform; deletes the "Direct Marketing" and "Personal Data Breach" definitions |
| 3 | Extension only for unexpected or unusual effort or multiple requests; unanswered request deemed rejected; refusal only if repeated without justification or requiring unusual effort; new complaint route to SDAIA |
| 4(7) | Appropriate and simplified language for all data subjects |
| 11(2)(c) | Explicit consent for solely automated decisions only where they affect data subjects' rights or interests |
| 18 (Repeated) | Privacy policy in clear, simplified language consistent with the language customarily used for the service |
| 19 | Retain-minimum duty and "data maps" reference deleted |
| 23(1) | NCA controls where applicable; otherwise recognised cybersecurity standards and best practice |
| 23(2) | "The Controller shall store Personal Data within the Kingdom." Transfers and disclosures abroad still permitted under the Law and Regulations |
| 24 | Notify SDAIA within 72 hours of any breach, damage or unauthorised access; harm test kept only for notifying data subjects |
| 25 | Triggers recast: sensitive data or data of minors or persons lacking capacity; linking datasets; large scale or regular and systematic monitoring; any emerging technology; solely automated decisions affecting rights or interests. "Serious harm" catch-all deleted |
| 28 | Consent for all promotional or awareness messages; verify consent where a prior relationship exists; Telecommunications and IT Act reference removed |
| 29 | Applies to processing for marketing purposes; on withdrawal, stop and destroy the resulting data |
| 32 | DPO triggers: public entity providing services involving personal data; regular and systematic monitoring on a large scale; core sensitive-data processing. DPO details filed on the platform. DPO Appointment Rules repealed |
| 33 | RoPA content list, "written" requirement and SDAIA templates deleted; retention for processing plus 5 years kept |
| 34 | Mandatory registration: public entities; core activity requires processing; sensitive data or data of persons lacking capacity; any transfer or disclosure outside the Kingdom; individuals beyond personal use. Per-controller register on the platform holding PDPL Art 31 records. Register Rules repealed |
| 35 | Deleted (licensing of accreditation bodies) |
| 36 | Audit and inspection under the 2026 licensing and audit rules |
| 36 (Repeated) | 20 business days to answer SDAIA; extension at SDAIA's discretion |
| 37 | 90-day complaint window removed; SDAIA may disclose complaint data (minimum necessary) |
| 38 | In force 60 days after Gazette publication |
Open question. Draft Art 23(2) does not say whether a copy must stay in the Kingdom when a transfer is lawful. Commentators read it as possibly requiring one.
The Arabic text controls. This summary is checked against the English consultation text dated 6 October 2026; the Istitlaa page itself could not be opened.
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21