Which entity types fall under which instruments? The matrix answers it: rows are entity types, columns are instruments grouped by regulator, and each cell carries a code.
B binding; E supervisory expectation; G guidance; C conditional (hover for the condition); P proposed in a draft that is not yet in force.
The Anti-Cyber Crime Law binds everyone within its territorial reach, including foreign entities whose acts affect the Kingdom.
PDPL duties are cumulative with sector rules: a SAMA or CMA licensee, a health provider or a cloud provider is subject to both, and the stricter rule governs in practice.
For how PDPL triggers (registration, DPO, DPIA, breach notice, in-Kingdom storage) would change under SDAIA's October 2026 draft, see PDPL obligation triggers.