Wadira: Find your way through Saudi data & privacy law.
Guide to Saudi data & cybersecurity law
The PDPL Instrument Family: The complete PDPL set spans the Law, two Regulations, several Rules and instruments, and a family of Guidelines. See the interacti
SAMA vs CMA: How the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) compare on cybersecurity and data, as at 20 October 2026.
Privacy, Recording & Surveillance: Four layers govern privacy, recording and surveillance in the Kingdom, with the PDPL as an overlay: 1. Basic Law of Governance: Ar
CMA Scope: The Capital Market Authority (CMA) regulates listed issuers (disclosure, offers, governance) under the Capital Market Law. Its Cyb
Regulatory Currency & Consultation: Status as at 20 October 2026. The Implementing Regulation (IR) of the PDPL is in force in its September 2023 text. The April–May 2
NDI: Two Levels: The National Data Index operates at two levels: - Level 1: NDMO Standards: the requirements (mandatory for government). - Level 2:
Applicability Matrix: Which entity types fall under which instruments? The matrix(/matrix) answers it: rows are entity types, columns are instruments gr
About and methodology: Wadira is an independent, database-driven reference to Saudi Arabia's data-protection, cybersecurity and data-governance regime: t
Data Localisation and Hosting Map: Saudi Arabia has no single localisation rule. Where data must be stored depends on the regime that covers the data and the entity,
Incident and Breach Reporting Map: One incident can trigger several reporting duties. They are parallel duties: notifying SDAIA does not discharge NCA or sector repo
How the Framework Fits Together: Saudi Arabia's data, cybersecurity and governance regime is tiered. The tier numbers below are the same ranks used across Wadira's