PDPL obligation triggers: current versus proposed

SDAIA's draft amendments to the Implementing Regulation (IR), published on Istitlaa on 6 October 2026 (comments close 5 November 2026), would change when the main PDPL duties are triggered. The table compares the current position with the draft. Every draft cell is proposed (P): nothing changes unless the amendments are adopted, and they would take effect 60 days after publication in the Official Gazette.

Obligation	Current position	Proposed (October 2026 draft)
Registration in the National Register of Controllers	Register Rules Art 2: in-Kingdom controllers that are public entities, whose main activity involves processing personal data, or that process sensitive data; individuals processing beyond personal or family use	P Draft IR Art 34: public entities; core activity requires processing; sensitive data or data of persons lacking capacity; any transfer or disclosure outside the Kingdom; natural persons beyond personal use. Register Rules repealed
Data protection officer	DPO Rules Art 5: public entity providing large-scale processing services; core activities requiring regular and systematic monitoring; core activities involving sensitive data	P Draft IR Art 32: public entity providing services involving personal data (no large-scale test); regular and systematic monitoring on a large scale; core sensitive data. DPO Rules repealed
Data protection impact assessment	IR Art 25: sensitive data; linking datasets; large-scale or repetitive processing of data of persons lacking capacity, constant monitoring, new technologies or automated decisions; products likely to cause serious harm to privacy	P Draft IR Art 25: sensitive data or data of minors or persons lacking capacity; linking datasets; large scale or regular and systematic monitoring; any emerging technology; solely automated decisions affecting rights or interests. Serious-harm catch-all deleted
Breach notice to SDAIA	IR Art 24(1): within 72 hours where the incident potentially causes harm or conflicts with rights or interests	P Draft IR Art 24: within 72 hours of any breach, damage or unauthorised access. Harm test kept only for notifying data subjects
Storage in the Kingdom	No storage duty; transfers under PDPL Art 29 and the Transfer Regulation	P Draft IR Art 23(2): "The Controller shall store Personal Data within the Kingdom"; transfers and disclosures abroad still permitted under the Law
Answering SDAIA requests	No set period	P Draft IR Art 36 (Repeated): 20 business days, extendable at SDAIA's discretion
Direct marketing consent	IR Art 28: consent required where there is no prior interaction	P Draft IR Art 28: consent for all promotional or awareness messages
Complaints to SDAIA	90-day window	P Draft IR Art 37: window removed

What it means in practice

Cross-border transfers become a registration trigger in their own right, so most organisations using foreign cloud or group systems would need to register.
Public entities would need a DPO whenever they provide services involving personal data, without a large-scale test.
Breach reporting to SDAIA would no longer depend on likely harm, which aligns the IR with PDPL Art 20(1).
Whether draft Art 23(2) requires a local copy even where a transfer is lawful is not settled; commentators read it both ways.

See the draft record, the Implementing Regulation and the consultations tracker.

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21