Saudi Arabia is the biggest AI market in the Gulf, and also the most regulated. But the rules are spread out: a personal data protection law enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA), cybersecurity controls from the National Cybersecurity Authority (NCA), sector rules for banks, and AI frameworks that are mostly guidance or still in draft. This article brings together what each says about an AI system that processes data in the Kingdom, what is in force today and what is coming.

First: the PDPL is fully in force, and SDAIA is enforcing it

The Personal Data Protection Law (PDPL) was issued by Royal Decree M/19 in 2021, amended in March 2023, and came into force on 14 September 2023. Organisations were given a year’s grace, so it has been fully enforceable since 14 September 2024, according to Clyde & Co and CMS. What matters most for an AI system:

  • Transfers abroad are allowed, with safeguards. They are governed by Article 29 of the Law and the Regulation on Personal Data Transfer outside the Kingdom, reissued in September 2024. It sets three safeguards: standard contractual clauses (which may not be modified), binding common rules, and a certificate of accreditation. A transfer risk assessment is needed when one of these safeguards is used, or when sensitive data is transferred on a continuous or widespread basis, according to Mayer Brown. SDAIA has not yet published a list of countries with adequate protection.
  • No general requirement to store data in the Kingdom, for now. Clyde & Co says the current framework does not impose one. The October 2026 draft could change that (see the next section).
  • Breach notification within 72 hours. SDAIA must be told within 72 hours where a breach may harm data subjects or affect their rights, and data subjects must be told without undue delay.
  • A data protection officer, and registration. A DPO is required for public entities processing at large scale, organisations that regularly monitor individuals, and organisations whose core activity is processing sensitive data. Controllers register in the national register through the National Data Governance Platform, according to Digital Policy Alert.
  • Fines of up to SAR 5 million. Per violation, doubled for repeat offences, according to CMS. SDAIA’s violation committees issued 48 decisions in 2025, covering processing or disclosure without a legal basis, weak safeguards, and marketing messages sent without consent, according to the IAPP. In other words, the law is no longer just text.

Second: a draft that could require storage in the Kingdom

On 6 October 2026 SDAIA published draft amendments to the Implementing Regulation, open for comment on the Istitlaa platform until 5 November 2026. According to Reed Smith and Clyde & Co, the draft adds a requirement to store personal data in the Kingdom, makes breach notification to SDAIA within 72 hours apply regardless of harm, and requires any controller that transfers personal data abroad to register. It is a draft, not law in force, and it is the second round after a 2025 draft that was never adopted. We cover it in its own article: Saudi Arabia may require personal data to stay in the Kingdom.

Third: government and critical infrastructure

The NCA’s Essential Cybersecurity Controls (ECC-2:2024) are mandatory for government entities and their affiliated companies, and for private organisations that operate or host critical national infrastructure, according to the NCA. The Cloud Cybersecurity Controls (CCC-2:2024) removed the in-Kingdom hosting controls of the first version and refer data localisation to SDAIA’s National Data Management Office. Under the Ministry of Communications and IT’s Cloud First Policy, government data classified as secret or top secret is hosted with government cloud providers.

Fourth: banks

Under the Saudi Central Bank’s (SAMA) Rules on Outsourcing, material outsourcing needs SAMA’s written no-objection. Where the provider is outside the Kingdom, the bank must explain why the service cannot be performed inside it, provide a legal opinion, and ensure SAMA can access the provider. Customer information may not be shared outside the bank without SAMA’s prior written approval. We found no AI-specific principles from SAMA, but any cloud model that reads customer data is likely to fall under these rules.

Fifth: AI itself, guidance frameworks and drafts under consultation

Saudi Arabia has no AI-specific law in force, according to CMS and Access Partnership. What does exist:

  • AI Ethics Principles (SDAIA, 2023). Seven guidance principles, with optional product badges and an accreditation for AI service providers. Forty organisations were accredited in the first round in January 2025, according to the Saudi Press Agency.
  • Generative AI guidelines (January 2024). One version for government entities and one for the public.
  • National AI Risk Management Framework (2026). It covers government and private organisations and names large language models explicitly, but it is a governance tool that creates no new legal obligations, according to Gowling WLG.
  • Drafts under consultation. SDAIA’s Responsible AI Policy (consulted April to May 2026), which proposes risk tiers, registration of some systems and audits of high-risk systems. The NCA’s AI Cybersecurity Guidelines (consulted July to August 2026), covering generative AI and agents. And the Communications, Space and Technology Commission’s draft Global AI Hub Law (April 2025) on “data embassies”. We found no final text for any of them as of this article.

When running AI on-premises is the sensible choice in Saudi Arabia

  1. When you are a government entity or run critical infrastructure. The NCA controls are mandatory for you, and classified data is hosted with the government cloud. A model inside your own data centre stays within the boundary you already audit.
  2. When you are a bank. A cloud model outside the Kingdom that reads customer data likely means a SAMA no-objection and a justification for not doing the work in-Kingdom. Running inside the bank removes that question.
  3. When you do not want to depend on how the localisation draft ends. If the in-Kingdom storage requirement is adopted, a system that already runs inside does not need to move.
  4. In every case, log everything. A 72-hour breach deadline, and the violation decisions SDAIA has started issuing, need logs that tell you quickly who saw what, and when.

Where we stand

We will not tell you Saudi law forces you to run on-premises today, because in general it does not. But government entities and banks face conditions that make an offshore cloud harder, and the draft on the table points towards in-Kingdom storage. Orchestra, our Arabic model, runs inside your data centre or in an in-Kingdom private cloud, and comes with the indexes, the logs and the safety layer. For comparison, read about the UAE, Qatar, Kuwait, Oman and Bahrain.

This article summarises public sources and is not legal advice. The regulatory picture is moving, so check the official texts and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.