How the Framework Fits Together

Saudi Arabia's data, cybersecurity and governance regime is tiered. The tier numbers below are the same ranks used across Wadira's framework pages; the full model, with UK and US mappings, is in How the tiers work.

Tier 0 · Constitutional / Sharia sits at the base: the Basic Law of Governance (Arts 37 & 40) and Sharia principles.
Tier 1 · Primary law: the PDPL is the horizontal baseline for personal data, alongside parallel primary laws such as the Anti-Cyber Crime Law.
Tier 2 · Cabinet instruments: Council of Ministers resolutions, which constitute the regulators themselves (SDAIA's Organizational Arrangements are a Council resolution).
Tier 3 · Regulations implement the law (the Implementing Regulation; the Data Transfer Regulation).
Tier 4 · Rules & instruments add operational detail (National Register, DPO Rules, SCCs, BCRs).
Tier 5 · Guidelines give non-binding guidance.

Sector regulators (NCA, SAMA, CMA, CST, MOH) layer their own requirements on top, inheriting the PDPL as a baseline. NDMO Standards feed the NDI. AI is a separate SDAIA family (ethics, generative-AI and adoption guidance).

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-08-13