General Rules for Secondary Use of Data

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Data Management & Governance
Tier	Rules, controls & standards
Legal status	In force
Instrument number	22-1 · SDAIA Board of Directors
Issued	2025-12-02 (11/06/1447H)
Version	1.0
Dates	Issue 1.0. SDAIA Board Decision No. 22-1 (11/06/1447H, 2 December 2025).
Last verified	2026-10-20

General Rules for Secondary Use of Data, issue 1.0. Approved by SDAIA Board Decision No. 22-1 dated 11/06/1447H (2 December 2025); public reporting dates from 30 December 2025. They complement the Data Sharing Policy.

Three request types: government to government; government to private for public interest; private to government for research, development and innovation.
Six principles; profit-oriented purposes are excluded; data minimisation applies.
Government-to-government requests go through the Data Marketplace.
Personal data must be processed under the PDPL.
Proposed: SDAIA's draft amendments to the PDPL Implementing Regulation (IR) (consultation 6 October to 5 November 2026) add Art 23(2): 'The Controller shall store Personal Data within the Kingdom', with transfers still permitted under the Law. If adopted, this would apply to personal data in secondary-use data and make any transfer abroad a registration trigger.

Documents

Updates for this instrument

2025-12-02 · SDAIA issues General Rules for Secondary Use of Data: Approved by SDAIA Board Decision No. 22-1 (11/06/1447H, 2 December 2025), the General Rules for Secondary Use of Data (issue 1.0) govern reuse of data beyond its original purpose. They cover three request types (governme

In this framework

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21