Regulatory Currency & Consultation

Status as at 20 October 2026. The Implementing Regulation (IR) of the PDPL is in force in its September 2023 text. The April–May 2025 draft was not enacted. A revised draft was published on 6 October 2026 (comments to 5 November 2026). Main changes:

a default duty to store personal data in the Kingdom (Art 23(2));
breach harm threshold for SDAIA notification removed (Art 24);
consent for all promotional messages (Art 28);
DPO and Register Rules repealed into the IR, with registration required for any cross-border transfer (Arts 32, 34);
RoPA content list and templates removed (Art 33);
90-day complaint window removed (Art 37);
20 business days to answer SDAIA requests (Art 36 (Repeated)).

In force 60 days after Gazette publication if adopted.

Other drafts. Standards guides for the certification and audit market (July 2026) and the practising-activities requirements (April 2025). No final texts as at 20 October 2026.

Enforcement is active: SDAIA announced 48 violation decisions in January 2026 and a further round in June 2026. See PDPL enforcement.

Financial sector. SDAIA is the PDPL competent authority. PDPL Art 30(1) applies without prejudice to the powers of the Saudi Central Bank (SAMA), and Art 42 requires coordination with SAMA. SDAIA and SAMA signed a supplementary MoU on 5 February 2025 on monitoring financial institutions' PDPL compliance. SAMA Circular 43045328 (December 2021) requires its licensees to comply.

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21