Saudi Arabia’s draft data protection amendments: in-Kingdom storage, a 72-hour breach clock and AI-triggered impact assessments

SDAIA published draft amendments to the PDPL Implementing Regulations on the Istitlaa public consultation platform, open from 6 October to 5 November 2026. They are proposals, not law: SDAIA will review the comments and may adopt them as drafted or change them.

• Storage in the Kingdom. Controllers would keep personal data stored inside Saudi Arabia. Transfers abroad would remain possible where they meet the law and its transfer rules.
• A 72-hour breach clock with no harm threshold. SDAIA would be notified within 72 hours of becoming aware of a breach, whether or not harm is likely. Notifying individuals would still depend on the risk to them.
• More impact assessments. New triggers for processing involving minors, large-scale or systematic monitoring, emerging technologies, and automated decisions affecting people's rights or interests. Most AI products used on personal data would be caught.
• Mandatory registration. Registration in the National Register of Controllers for public entities, controllers whose core business is processing personal data, those handling sensitive data, and anyone transferring or disclosing data outside the Kingdom.
• Deadlines. 20 business days to answer SDAIA, and a data subject request unanswered after 30 days treated as refused, with a route to complain.
• Plain-language privacy notices in the language customarily used with the audience, which in practice means Arabic, and wider duties to appoint and register a data protection officer.

For foreign cloud, SaaS and AI suppliers, the storage and registration proposals matter most. A Saudi customer that must keep data in the Kingdom and register its transfers will ask its suppliers where the data sits and who reaches it from abroad, and will want the answer before contract. SDAIA has also opened a personal data protection track in its data regulatory sandbox for organisations testing new approaches.

• If the draft affects you, comment on Istitlaa before 5 November 2026.
• Map where Saudi personal data is stored today, including backups and support access, and what would have to move.
• List your AI and automated decision features that touch Saudi personal data, and draft the impact assessment now rather than after the regulations change.
• Check whether your breach process can notify SDAIA within 72 hours of awareness, without waiting for a harm assessment.

• Istitlaa public consultation platform
• SDAIA opens public consultation on proposed amendments to the PDPL Implementing Regulation (Al Tamimi & Company, 9 October 2026)
• The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL (Clyde & Co, 8 October 2026)
• SDAIA data regulatory sandbox, personal data protection track (Saudi Press Agency)

Checked 19 October 2026. This briefing is not legal advice. We never give an independent opinion on work we helped build, and we never sell the fix after giving one.