Wadira: Find your way through Saudi data & privacy law.
A law-firm note of 8 October 2026 reports that SDAIA opened controller registration to organisations outside the Kingdom, through an authorised representative and Ministry of Foreign Affairs digital-identity verification, on the basis of PDPL Arts 2 and 33(4). The primary announcement has not been located; whether registration is mandatory for overseas controllers is not confirmed. Rules Governing the National Register of Controllers within the Kingdom
SDAIA opened registration for the personal data protection track of its Data Regulatory Sandbox on 6 October 2026, for two months. It is open to licensed private entities in the Kingdom that process personal data and are registered in the National Register of Controllers. Data Regulatory Sandbox
SDAIA published revised draft amendments to the PDPL Implementing Regulation on Istitlaa; comments close 5 November 2026. Main changes: a default duty to store personal data in the Kingdom (Art 23(2)); no harm threshold for notifying SDAIA of breaches (Art 24); consent for all promotional messages (Art 28); DPO and Register Rules repealed into the Regulation, with registration required for any cross-border transfer (Arts 32, 34); RoPA content list removed (Art 33); 20 business days to answer SDAIA (Art 36 (Repeated)); 90-day complaint window removed (Art 37). In force 60 days after Gazette publication if adopted. Overtakes the April–May 2025 draft. Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
On 2 October 2026 the NCA reaffirmed that cybersecurity providers must register through Haseen (licensing.haseen.gov.sa), a requirement in place since 1 August 2022. Haseen is also the incident-reporting channel.
CST published a report on cloud service latency for the first half of 2026 on 1 October 2026. It is a market report, not a regulatory instrument. Cloud Computing Services Provisioning Regulations (version 4)
The Capital Market Authority (CMA) opened a consultation on 24 September 2026 on draft restrictions for algorithmic trading. The closing date has not been confirmed.
SDAIA launched five data and AI capability frameworks (training, academic, K-12, professional standards and a cross-discipline university curriculum) and the first cycle of the National AI Index, which measures government AI maturity across seven areas. The same week SDAIA presented its draft Responsible AI Policy at the UNESCO forum in Riyadh (17–18 September 2026). Data and AI Capability Frameworks (2026)
SDAIA and the Ministry of National Guard are reported to have launched a biometric sub-track of the Data Regulatory Sandbox, with a healthcare focus. Secondary source only. Data Regulatory Sandbox
The NCA ran inspection visits in September 2026 citing its Statutory Enablers (Royal Decree M/117). Statutory Enablers of the National Cybersecurity Authority (Royal Decree M/117)
The Saudi Central Bank (SAMA) reportedly issued circular No. 482021280 on 27 August 2026 on enhancing operational resilience against quantum computing risks, with deadlines of 31 December 2026 and 31 March 2027. The rulebook text has not yet been checked. Enhancement of Operational Resilience to Address Quantum Computing Risks
CST consulted from 16 August to 12 September 2026 on fee rules for numbering and number portability. The consultation has closed; no final rules found as at 20 October 2026.
The Basic Statute of the International Center for AI Research and Ethics (ICAIRE), a UNESCO Category 2 centre in Riyadh, was published in Umm Al-Qura. Council of Ministers Decision No. 200 (21/02/1448H) and Royal Decree M/77 (27/02/1448H). The SDAIA President chairs the board. ICAIRE Basic Statute
Two NCA Rules made under the Statutory Enablers (Royal Decree M/117) were published: the Rules for the Detection and Investigation of Cybersecurity Violations (Umm Al-Qura, 3/2/1448H, 17 July 2026), covering inspectors, urgent suspension and investigation; and the Rules for Regulating the Reporting of Cybersecurity Violations, with a whistleblower reward capped at the lower of SAR 50,000 or 1% of the fine collected. Both are in force from publication on the NCA website. Rules for the Detection and Investigation of Cybersecurity Violations
SDAIA issued a National AI Risk Management Framework (guidance): a four-stage lifecycle (context and scope; identify, assess and treat; monitor; review), risk scored on a likelihood-by-impact matrix across seven risk categories, and seven principles matching the AI Ethics Principles. National AI Risk Management Framework
The NCA consulted (14 July to 14 August 2026) on an updated Saudi Cybersecurity Higher Education Framework (SCyber-Edu), which sets minimum curriculum requirements, knowledge units and professional standards for cybersecurity degree programmes. The consultation closed 14 August 2026; as at 20 October 2026 the NCA still publishes SCyber-Edu-1:2020. Saudi Cybersecurity Higher Education Framework (SCyber-Edu-1:2020)
The Economic Cities and Special Zones Authority (ECZA) published Companies Rules for the special economic zones in Umm Al-Qura on 10 July 2026 (item 4001347). They apply alongside the zone bylaws, including those of the Cloud Computing and Informatics SEZ. Regulatory Bylaws of the Cloud Computing and Informatics Special Economic Zone
Three draft standards guides implementing the 2026 licensing rules (standards for issuing accreditation certificates to controllers and processors, for licensing personal-data audit and inspection activities, and for licensing certificate-issuance activities) were posted on Istitlaa about 7 July 2026 and re-publicised by SPA on 21 July, 23 July and 6 August 2026. SDAIA re-invited comments on 6 August; the closing date is unconfirmed. No final versions found as of 20 October 2026. Draft standards guides for PDPL certification and audit providers
The NCA consulted (5 July to 5 August 2026) on draft AI Cybersecurity Guidelines (AICG-1:2026, code as given in secondary sources), its first AI-specific instrument. Four domains: governance, defence, resilience and third-party security, covering generative and agentic AI. Consultation closed 5 August 2026; no final as of 20 October 2026. AI Cybersecurity Guidelines (draft)
SDAIA's violation-review committees announced a further package of decisions (fines and warnings against several entities). SDAIA's own SPA statement cited direct marketing without explicit consent, failure to maintain measures enabling timely responses to data-subject requests, 72-hour notification failures, inadequate security measures and failure to appoint a required DPO. No entity names or amounts were disclosed. No further enforcement round announced between 30 June and 20 October 2026. Personal Data Protection Law (PDPL)
The NCA released SCyWF-1.5:2026 on 24 June 2026, superseding SCyWF-1:2020. It revises job roles, task, knowledge and skill lists and competency areas, and adds a Career Progression appendix. The NCA recommends adoption; it is a reference framework, not a binding control set. Saudi Cybersecurity Workforce Framework (SCyWF-1.5:2026)
The NCA consulted (24 June to 24 July 2026) on a draft classification of violations of NCA cybersecurity requirements and a matching penalties schedule, made under its Statutory Enablers (Royal Decree M/117). It would be the first formal penalty schedule behind the ECC, NCNICC and other NCA controls. Consultation closed 24 July 2026; no final as of 20 October 2026. Cybersecurity Violations Classification and Corresponding Penalties (draft)
SDAIA announced the Data Monetization Policy (سياسة تحقيق الإيرادات من البيانات), v1.0, also referred to as the Data Revenue Generation Policy. It covers government data used in data products and services, and data private entities obtain from or while working for government; data classified Secret or above is excluded. Raw data may not be sold, government-to-government provision and open data stay free, products are registered in NDMO's national register, and personal data must be processed under the PDPL. Data Monetization Policy
As drafted, all public and private entities must report any actual or suspected incident through Haseen. Five severity levels apply, from Level 1 (catastrophic) to Level 5 (a single workstation). Separately, four response tiers apply to NCA requests: immediate 2 hours, very urgent 12 hours, urgent 48 hours, normal 72 hours. Records must be kept at least 15 years; annual drills; TLP sharing. Consultation closed 10 July 2026. No final framework as of 20 October 2026. National Framework for Cybersecurity Information Sharing and Incident Response (draft)
The Ministry of Media, with SDAIA, is reported to have issued AI Principles in Media. Their binding status is not stated. AI Principles in Media
The Saudi Food and Drug Authority (SFDA) issued version 4.0 of its Regulations and Requirements for Conducting Clinical Trials on Drugs on 10 May 2026: Saudi Clinical Trials Registry registration, AI use declared in submissions, and IRB permission for exporting bio-samples under M/59. Regulations and Requirements for Conducting Clinical Trials on Drugs (v4.0)
The NCA consulted (4 to 22 May 2026) on draft Cybersecurity Controls for National Events and Occasions. Consultation closed 22 May 2026; no final as of 20 October 2026. Cybersecurity Controls for National Events and Occasions (draft)
SDAIA consulted from 3 April to 3 May 2026 on a draft Responsible AI Policy for government, private and non-profit entities and individuals. Reported content: four risk tiers (critical, high, limited, low), registration of certain AI applications, ethics labelling, audit for high-risk systems and a sandbox. SDAIA presented it at the UNESCO forum in Riyadh (17–18 September 2026). No final text found as at 20 October 2026. Responsible AI Policy (draft)
The Saudi Central Bank (SAMA) began licensing open banking providers on 26 March 2026, under the Open Banking Framework (Release 1 account information, 2022; Release 2 payment initiation, 2 September 2024). Open Banking Framework
SDAIA issued non-binding guidelines for the Year of AI 2026. Year of AI 2026 Guidelines
The Saudi Central Bank (SAMA) reportedly issued its Oversight Framework for Payment Systems and Their Operators by circular 472047719 on 8 March 2026. Oversight Framework for Payment Systems and Their Operators
The Capital Market Authority (CMA) issued a framework for robo-advisory services in March 2026.
The NCA consulted (25 February to 26 March 2026) on RFCS-1:2026, a draft licensing framework for all providers of cybersecurity services, products and solutions serving the Kingdom, managed SOCs excluded. Tier I would need 75% Saudi ownership and SAR 10m capital; licences would run for five years. Consultation closed 26 March 2026; no final as of 20 October 2026. Regulatory Framework for Licensing Cybersecurity Services, Products and Solutions (RFCS-1:2026, draft)
SDAIA President's decisions dated 25/06/1447H (16 December 2025), announced 17 February 2026 and published in Umm Al-Qura on 6 March 2026, create the PDPL compliance-services market: licences for accreditation-certificate issuers (SAR 10m capital, at least 10 directly employed assessors, 3-year term) and for personal-data audit and inspection providers, plus rules for issuing 2-year accreditation certificates to controllers and processors. Certificates also serve as a cross-border transfer safeguard under the Transfer Regulation. Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
The Regulatory Bylaws of the Cloud Computing and Informatics Special Economic Zone (Council of Ministers Resolution 468) were published in Umm Al-Qura on 16 January 2026 and came into force on 16 April 2026. CST licenses activities in the zone; Saudi law applies where the Bylaws are silent (Art 28). Regulatory Bylaws of the Cloud Computing and Informatics Special Economic Zone
SDAIA's violation-review committees issued 48 decisions confirming personal-data-protection violations during the preceding year, the first substantive enforcement wave. SDAIA cited processing without a legal basis, disclosure without a legal basis, inadequate protection measures and marketing without consent. Decisions were reported in aggregate; no entities were named. Personal Data Protection Law (PDPL)
SDAIA launched the third National Data Index cycle, covering 214 government entities (SPA, 28 December 2025). In the same month it honoured six entities and reported more than 300 government data management offices. National Data Index (NDI)
The NCA issued NCNICC-1:2025 on 28 December 2025. The controls appear to apply to non-CNI private-sector entities identified by the NCA; others may use them as best practice. Category A (over 250 staff or revenue over SAR 200m) has 65 controls; Category B (6 to 249 staff or SAR 3m to 200m) has 26. No effective date or grace period appears in the text; penalties sit under Royal Decree M/117. Non-Critical National Infrastructure Cybersecurity Controls (NCNICC-1:2025)
Approved by SDAIA Board Decision No. 22-1 (11/06/1447H, 2 December 2025), the General Rules for Secondary Use of Data (issue 1.0) govern reuse of data beyond its original purpose. They cover three request types (government to government; government to private for public interest; private to government for research, development and innovation) under six principles, and exclude profit-oriented purposes. Personal data must be processed under the PDPL. General Rules for Secondary Use of Data
SDAIA's public consultation (27 April to 27 May 2025) proposed amendments to the Implementing Regulation: folding the DPO-appointment and controller-registration rules into it, simplifying the RoPA requirement, adding a plain-language privacy-policy clause, tightening the marketing-consent rule and removing the 90-day complaint window. Not enacted. Overtaken by the revised draft of 6 October 2026. Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
In May 2025 SDAIA reissued its AI documents: the 2025 AI Ethics Principles (SDAIA-P114E), the Generative AI Guidelines for the Public (SDAIA-P115E) and for Government (SDAIA-P116E), the Saudi Academic Framework for AI Qualifications (SDAIA-P118), the final Deepfakes Guidelines (SDAIA-P119) and v2 of the AI Adoption Framework (SDAIA-P121). AI Ethics Principles
SDAIA consulted (April to May 2025) on draft requirements for practising personal data protection activities (consultancy, training, compliance technology, events) under PDPL Art 33(1), a separate instrument from the Implementing Regulation amendments. No final text found as of 20 October 2026. Draft Requirements for Practising Personal Data Protection Activities (April 2025)
CST published the draft Global AI Hub Law on Istitlaa for consultation from 14 April to 14 May 2025. It proposes private, extended and virtual hubs (the "data embassy" model), with hosted data governed by the guest state's law. As at 20 October 2026 no enacted text has appeared in Umm Al-Qura. Global AI Hub Law
SDAIA published a non-binding, four-phase methodology for assessing the risks of transferring personal data outside the Kingdom, with a companion risk-assessment tool on the National Data Governance Platform. Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
SDAIA and the Saudi Central Bank (SAMA) signed a supplementary memorandum of understanding on monitoring financial institutions' compliance with the PDPL. SDAIA remains the PDPL competent authority; PDPL Art 30(1) applies without prejudice to SAMA's powers and Art 42 requires coordination with SAMA. Personal Data Protection Law (PDPL)
SDAIA began assessing AI products on the National Data Governance Platform against the AI Ethics Principles. Five voluntary badges (Aware, Adopter, Committed, Trusted, Pioneer) plus an accreditation certificate, each valid for one year. AI Ethics Principles
Council of Ministers Resolution 430 (23/06/1446H, 24 December 2024), published in Umm Al-Qura on 17 January 2025, amended the Organisation of the Communications, Space and Technology Commission. It adds digital content platforms to CST's sectors and rewrites its functions and board. Organisation of the Communications, Space and Technology Commission (as amended)
Royal Decree M/117 dated 21/6/1446H (22 December 2024) issued the NCA's Statutory Enablers, a standalone enforcement instrument and not an amendment to the NCA Statute. Penalties include warnings, licence or service suspension and fines up to SAR 25m; government entities are excluded. In force on publication in Umm Al-Qura, 17 January 2025. Statutory Enablers of the National Cybersecurity Authority (Royal Decree M/117)
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21