The news
The Saudi Data and Artificial Intelligence Authority (SDAIA) published draft amendments to the Implementing Regulation of the Personal Data Protection Law on 6 October 2026. The draft is open for public comment on Istitlaa, the government's consultation platform, until 5 November 2026.
The change with the widest reach is a proposed requirement for controllers, the organisations that decide how personal data is used, to store that data inside the Kingdom. Transfers abroad would still be allowed under the rules of the law and its regulations. The law firm Pinsent Masons says the wording raises questions for cloud hosting and backups.
The draft also drops the harm test for breach notices, so SDAIA would have to be told within 72 hours of any personal data breach. Registration in the National Register of Controllers would become mandatory in more cases, including for controllers that process sensitive data or transfer personal data outside Saudi Arabia. Organisations would have 20 business days to answer a request from SDAIA, and a request from an individual about their data that goes unanswered past the deadline, normally 30 days, would count as refused.
Marketing messages would need consent the sender can prove and a simple way to opt out, and privacy notices would have to be written in clear, simple language. If approved, the amended regulation would take effect 60 days after it is published in the Official Gazette.
What it means for you
- If your customer data is held on cloud servers outside Saudi Arabia, the storage rule is the part to watch, because its final wording will decide whether that data has to move.
- Any breach of personal data, even one unlikely to cause harm, would have to be reported to SDAIA within 72 hours.
- Companies that send data abroad or handle sensitive data, such as health records, would have to register with SDAIA.
- This is a draft. Nothing changes until the final text is published, and then there are 60 days to comply.
What to do now
- Find out where your customer data and backups are stored, including your CRM, online store and email tools.
- Read the draft on the Istitlaa platform and send your comments before 5 November if a change affects you.
- Check that your team can detect a data breach and report it within 72 hours.
- Keep proof of marketing consent and make it easy to opt out of your messages.
How Didset can help
We can review where your systems keep personal data and move them, or connect them, to hosting inside Saudi Arabia if the final rules require it.
Talk to us about it
