SDAIA Consults on Amendments to the Personal Data Protection Law Implementing Regulation

SDAIA published draft amendments to the PDPL Implementing Regulation on the Istitlaa platform, with feedback open until 5 November 2026. Proposals touch data storage, breach notification and controller registration.

What was announced

The Saudi Data and AI Authority (SDAIA) placed a project titled "Amendments to the Implementing Regulation of the Personal Data Protection Law" on Istitlaa, the unified public consultation platform run by the Saudi Competitiveness & Business Center. According to an SPA report of 8 October 2026, public feedback was open until 5 November 2026. The stated aim is to clarify the procedures and controls in the Implementing Regulation so that organisations can comply more easily, and to strengthen trust in services that depend on personal data.

Key details in the draft

The draft text on Istitlaa sets proposed wording next to the current text. Points that stand out for businesses include:

• Storage in the Kingdom: a proposed requirement for controllers to store personal data within Saudi Arabia, while transfers and disclosures abroad would remain possible under the PDPL and its regulations.
• Breach notification: controllers would notify SDAIA within 72 hours of becoming aware of a breach, damage or unauthorised access, with set content for the notice and a duty to keep copies of reports.
• Controller registration: registration in the National Register of Controllers through SDAIA's platform would be required in defined cases, such as public entities, controllers whose core activity requires processing personal data, and controllers handling sensitive data or data of people lacking legal capacity.
• Responding to SDAIA: entities would have 20 business days to answer SDAIA requests on implementation of the law, with extensions at SDAIA's discretion.
• Plain language: privacy information would need to be given in appropriate and simplified language.

Law firms commenting on the draft, including Clyde & Co, also point to proposed changes on impact assessments, direct marketing consent and data protection officer duties. These remain proposals until SDAIA issues a final version.

Why it matters for businesses

If adopted in this form, the storage and registration provisions could affect companies that host data outside the Kingdom, use regional cloud platforms or rely on overseas group systems. A breach-notification rule that is triggered by the incident itself, rather than by an assessment of likely harm, would also mean more notifications and tighter incident-response timelines. Marketing, HR and customer-service teams that process personal data would need to review consent records and privacy notices.

What to watch next

The consultation window closed on 5 November 2026. The next step is publication of a final text and its effective date. No final version or start date had been announced at the time of writing, so the draft should be treated as provisional.

What businesses may want to do: map where personal data is stored and which systems sit outside Saudi Arabia, check whether the organisation would fall within the registration triggers, and test whether incident-response procedures can meet a 72-hour notice to SDAIA. Final obligations should be confirmed against the official text once issued.

Sources

• Istitlaa (SCBC): Amendments to the Implementing Regulation of the Personal Data Protection Law
• Saudi Press Agency: 40 Projects Open for Feedback Through Istitlaa Public Consultation Platform
• Clyde & Co: The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL

How Sokrab can help

• PDPL compliance for websites and marketing teams
• Regulatory compliance for new businesses