KSA's Personal Data Protection Law (PDPL) has been fully enforceable since 14th September 2024. Over the past two years, organizations have been navigating overlapping obligations and answering the bigger question: are we ready to fully comply with the PDPL?
Since late 2024, PDPL has moved from deadline readiness to continuous compliance. The evolving nature of the regulations requires organizations to keep up with amendments, Implementing Regulations and other developments.
Most recently, on 6th October 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation regarding proposed amendments to the PDPL’s Implementing Regulations, which will run through 5 November 2026, opened registration for the Personal Data Protection Track within its Data Regulatory Sandbox, and opened registration to organizations outside the Kingdom.
Here’s what’s changed, what’s coming, and what to do next.
1. Enforcement Now Demands Compliance Evidence
The one-year grace period, starting 14th September 2023, ended, with the PDPL becoming fully enforceable on 14th September 2024. Two years on, organizations are past the deadline phase, with questions shifting from "are we ready for PDPL compliance?" to "how can we prove that our privacy controls comply with PDPL’s obligations today?"
Additionally, on 16th January 2026, the SDAIA announced that its Committees for Reviewing Violations issued 48 enforcement decisions throughout 2025, confirming violations and imposing penalties against organizations in breach of the PDPL. Noncompliance penalties can reach SAR 5 million per violation, can be doubled for repeat offenses, and unlawful disclosure of sensitive data carries criminal penalties.
Moreover, starting 7th July 2026, the SDAIA began sending a PDPL Compliance Verification Form to its registered data controllers. The form requires data controllers/organizations to provide information and evidence on how they’re complying with the PDPL. This includes demonstrating compliance with various obligations, including:
- Data governance: who is responsible for personal and sensitive data protection, and how decisions for personal data protection are made
- Legal basis: the ‘why’ behind obtaining consent and why certain types of personal data are processed
- Third parties: how vendors and data processors are chosen, contracted with and monitored
- Data retention and destruction: how long personal and sensitive data is kept before it is deleted
- Data subject rights: how data subjects/individuals can access, correct or delete their personal data, and how the mechanisms are implemented to facilitate such requests within the timeframe
- Cross-border data transfers: what data leaves the Kingdom, where it goes, and on what basis
- Incident response: the mechanisms behind detecting, assessing and reporting a data breach
- The appointment of a DPO: whether the organization has appointed a DPO and if one needs to be appointed
For organizations subject to the PDPL, it has moved past the ‘are we ready’ stage to ‘whether we can provide PDPL compliance.’ The form questions the controls, policies and frameworks organizations have implemented over this time to assess whether they are complying with the PDPL.
2. Where the Law Stands Now
Currently, the PDPL, its 2023 Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom (Transfer Regulation) are the well-defined rules organizations must follow, with SDAIA’s guidelines explaining how to apply them.
SDAIA continues to enforce the PDPL and its Regulations, with the compliance grace period ending on 14th September 2024. As of now, personal data transfers are allowed to countries recognized by SDAIA as offering a comparable level of data protection (though SDAIA hasn’t yet published an adequacy list), or through approved safeguards such as Standard Contractual Clauses (SCCs) and risk assessments.
3. The Amendments are Back Out for Consultation
SDAIA consulted on draft amendments to the Implementing Regulation in April 2025; those amendments were not finalized, and this is a revised draft. It is perhaps the most important recent development organizations must account for.
On 6th October 2026, the SDAIA opened a public consultation on proposed amendments to the PDPL’s Implementing Regulations, with feedback due within one month, by 5th November 2026, through the Istitlaa platform, Saudi Arabia's unified electronic Public Consultation Platform.
The draft proposes several key changes. If adopted, it would:
A. In-Kingdom local storage as the default
Strictly require controllers to store personal data within the Kingdom. Cross-border data transfers and disclosures would continue to be permitted under applicable laws and regulations.
The draft would add a new duty for controllers to store personal data inside the Kingdom. Transfers and disclosures abroad would still be allowed if they meet the existing PDPL transfer rules. Organizations relying on offshore hosting or regional infrastructure would need to review both where they store data and the basis for every transfer.
B. Consequences for missed data subject request deadlines
The existing 30-day response period (extendable by 30 days) stays. If a controller misses it, the request would be treated as rejected, and the data subject could complain directly to SDAIA.
C. Expanded data breach notification
Currently, data controllers are required to notify SDAIA within 72 hours of becoming aware of a personal data breach only if the breach may harm personal data or data subjects, or conflict with their rights and interests. Under the revised draft, data controllers would have to notify SDAIA of a breach regardless of whether it is likely to cause harm.
D. Expanded registration framework
Data controllers that transfer or disclose personal data outside the Kingdom would be required to register with the SDAIA.
E. Response window for SDAIA requests
Entities subject to the PDPL would have 20 business days to respond to requests from SDAIA regarding how they apply and implement the PDPL and its Implementing Regulations.
F. Policy and notice transparency
Privacy notices and policies would need to be written in clear, simplified, and accessible language that matches the language used to deliver the services or products to customers.
The draft also proposes revisions to other sections including impact assessments, marketing consent, DPO provisions, and a direct route for complaints to the SDAIA. However, none of this is approved or in force yet. After the consultation closes, SDAIA will review feedback and decide whether to adopt the amendments, with or without changes. If adopted, they’d take effect 60 days after publication in the Official Gazette.
For organizations, this means preparing for the amendments now: assess existing policies and controls against the draft's requirements.
4. Overseas Organizations Can Now Register
Until recently, only organizations with a Saudi commercial registration could register on SDAIA’s National Data Governance Platform. SDAIA has now opened a dedicated pathway for overseas organizations. Foreign controllers that meet the registration criteria (for example, those processing sensitive data or whose core activities involve processing personal data) can no longer cite the lack of local registration as an obstacle.
If the draft amendments are adopted, registration would also be required for controllers that transfer personal data outside the Kingdom, thereby capturing many multinationals. Overseas organizations should assess now whether they meet the criteria.
5. Cross-Border Data Transfers Still Rely on Safeguards
Despite the recently announced public consultation and the draft amendments, there’s still no adequacy list. SDAIA has still not published its list of jurisdictions offering an adequate level of protection. This means data transfers outside the Kingdom continue to rely on appropriate safeguards, such as standard contractual clauses (SCCs), binding common rules (BCRs), or transfer certification, and documented risk assessments.
For organizations, this means implementing a dedicated cross-border data transfer documentation system that tracks every data flow out of the Kingdom. This includes maintaining detailed records of the recipient, destination, and the legal basis for the transfer.
6. AI Takes Center Stage
As AI advances and organizations across several key industries continue to embrace it, the Saudi government recognizes the urgent need to accelerate AI adoption. Addressing this growing need, the Kingdom has designated 2026 as its Year of Artificial Intelligence. To support this, SDAIA has published AI governance guidance, including AI ethics principles, generative AI guidelines and an AI adoption framework.
Since a major chunk of that guidance is advisory, the PDPL continues to apply whenever AI systems process personal data, including the impact assessments required for newly adopted technologies and automated decisions.
Additionally, on 6th October 2026, the SDAIA opened registration for the Personal Data Protection Track in its Data Regulatory Sandbox. Registration is open for 2 months through the National Data Governance Platform, during which licensed private entities can test products built on personal data under regulatory supervision.
For organizations, this means treating PDPL and AI governance as one compliance initiative and considering the sandbox for new data-driven products.
7. Operationalize PDPL Compliance with Securiti
The consultation closes on 5 November 2026, but the direction is clear. Organizations that map their data and controls now will be ready for whatever version SDAIA adopts. It’s important to understand that SDAIA requires organizations to provide evidence of PDPL compliance. To keep up, organizations need a current, accurate view of their personal data. Securiti, a Veeam company, helps them get one:
- Discovery and classification: Discover personal and sensitive data across on-premises systems, cloud platforms, and SaaS applications, and classify it.
- Data mapping: Trace data flows across the data real estate, where that data is stored and how it flows across borders.
- Workflows: Maintain detailed records of processing activities (RoPA), keep these records up to date, and automate data subject rights fulfillment requests; obtain explicit consent; conduct impact and risk assessments; and devise a data breach incident response plan.
- Evidence: Automated records demonstrate that controls are working, enabling organizations to honor SDAIA requests with confidence.
See how Securiti helps organizations stay current with the PDPL and prove it. Request a demo.
