On 6 October 2026 the Saudi Data and Artificial Intelligence Authority (SDAIA) published extensive draft amendments to the Implementing Regulation of the Personal Data Protection Law, open for public comment on the Istitlaa platform until 5 November 2026. The headline change, according to analyses by Clyde & Co and Reed Smith, is an express requirement to store personal data inside the Kingdom. This article summarises what the draft says, and what it means for any AI system that processes data about Saudi staff or customers.

Where things stand today

The PDPL came into effect on 14 September 2023, and its grace period ended on 14 September 2024, when it became fully enforceable. According to Clyde & Co, the current framework does not impose a general requirement to store personal data within the Kingdom; transfers abroad are governed by Article 29 of the Law and the Regulation on the Transfer of Personal Data outside the Kingdom.

What the draft changes

  • A storage-in-Kingdom requirement (draft Article 23(2)). According to Reed Smith, the draft introduces “an express requirement for data controllers to store personal data within the Kingdom of Saudi Arabia”, alongside wording that allows transfer or disclosure outside the Kingdom in accordance with the Law and its regulations. The firm notes the wording is ambiguous: it could mean a local copy must always be kept, or a baseline rule that needs no local copy where the transfer is lawful. The final text has to settle that.
  • Mandatory registration for anyone transferring abroad (Article 34). Registration with the National Register of Controllers becomes mandatory for controllers that transfer or disclose personal data outside the Kingdom, alongside public entities and those processing sensitive data. Reed Smith notes this appears to apply equally to controllers based outside the Kingdom.
  • Impact assessments for automated decisions and emerging technologies (Article 25). A data protection impact assessment becomes required where processing results in automated decisions affecting individuals’ rights or interests, and where “emerging technologies” are used, a term the draft does not define.
  • Breach notification within 72 hours in every case (Article 24). The “potential harm” threshold is removed, so notification is required within 72 hours of awareness whether or not harm is likely.

The amendments enter into force 60 days after publication in the Official Gazette. Until then, the current transfer regulation applies.

Why this touches AI in particular

An AI system does not process data in one place. Personal data moves along at least three paths, and each of them can be a “transfer outside the Kingdom”:

  • The prompts themselves. Every question a staff member or customer types, and every document attached to it, goes to the model. If the model is a cloud API outside the Kingdom, every request is a transfer.
  • The indexes. Retrieval systems turn your documents, staff files and contracts included, into indexes. If the indexes are hosted abroad, the documents are effectively abroad.
  • The logs. Conversation and tracing logs hold the full text. Many monitoring tools send them to outside services by default.

And if the system is an agent that takes actions, such as approving leave or issuing a salary certificate, it may fall within the “automated decisions” that require an impact assessment.

A practical checklist before the final text lands

  1. Map the three paths for every AI system you run: where the model runs, where the indexes are stored, where the logs go. Any path that leaves the Kingdom needs a legal basis for transfer today, and may need a local copy and a registration tomorrow.
  2. Classify what each system does. An assistant that answers HR policy questions is not an agent that approves requests. The second is the candidate for an impact assessment.
  3. Make sure your logs let you notify within 72 hours: who asked, what they saw, and when. Without a full log you cannot know what leaked.
  4. Read the draft and comment on it through Istitlaa before 5 November if it affects your business model.

Where we stand

We build so that these questions do not arise in the first place. Orchestra, our Arabic model, runs inside your data centre in the Kingdom or in a private cloud there, together with the indexes, the logs and the safety layer, so no prompt, document or log leaves the Kingdom. Full, immutable logs give your compliance team what it needs for impact assessments and notifications. That does not replace your obligations as a data controller, but it takes the transfer path out of the equation. More on our Saudi Arabia page.

This article summarises public sources on a draft that is not yet final, and is not legal advice. Check the official text on Istitlaa and your legal counsel before acting.

Sources

Related pages

Download the one-page checklist: AI and data rules in the Gulf and Egypt, 2026 (PDF), or compare all seven countries on one page.