How the Framework Fits Together

Saudi Arabia's data, cybersecurity and governance regime is tiered.

Constitutional / Sharia sits at the base — the Basic Law of Governance (Arts 37 & 40) and Sharia principles.
Primary law: the PDPL is the horizontal baseline for personal data, alongside parallel primary laws such as the Anti-Cyber Crime Law.
Regulations implement the law (the Implementing Regulation; the Data Transfer Regulation).
Rules & instruments add operational detail (National Register, DPO Rules, SCCs, BCRs).
Guidelines give non-binding guidance.

Sector regulators — NCA, SAMA, CMA, CST, MOH — layer their own requirements on top, inheriting the PDPL as a baseline. NDMO Standards feed the NDI. AI is a separate SDAIA family (ethics, generative-AI and adoption guidance).

Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27