SDAIA Opens Personal Data Protection Track in Its Data Regulatory Sandbox

SDAIA opened registration for a Personal Data Protection track in its Data Regulatory Sandbox, letting licensed private companies test data-driven products under supervision. Registration runs for two months.

What was announced

On 6 October 2026 the Saudi Data and AI Authority (SDAIA) opened registration for a new Personal Data Protection Track within its Data Regulatory Sandbox, as reported by the Saudi Press Agency. Applications are made through the National Data Governance Platform, and the registration window stays open for two months.

Key details

• Purpose: to help companies build products and services that comply with the Personal Data Protection Law (PDPL) and its Implementing Regulation from the design stage.
• Who can apply: licensed private entities operating in Saudi Arabia whose innovative products or services involve processing personal data.
• Pre-condition: applicants must already be registered in the National Personal Data Protection Register on the National Data Governance Platform.
• How it works: admitted companies test their products or services under regulatory supervision, giving them a structured route to align with PDPL requirements before wider launch.

Why it matters for businesses

A regulatory sandbox gives firms a controlled setting to try new uses of personal data, such as analytics, AI-driven personalisation or new digital services, while discussing compliance questions with the regulator. For fintech, health-tech, e-commerce and software companies, this can reduce uncertainty about how the PDPL applies to features that do not fit neatly into existing guidance.

The track also signals SDAIA's emphasis on "privacy by design". Building consent, minimisation and security controls into a product early is usually cheaper than retrofitting them after launch. The announcement comes in the same month that SDAIA consulted on amendments to the PDPL Implementing Regulation, which shows that data protection rules in the Kingdom are still evolving.

What to watch next

SDAIA has not published, in the SPA announcement, the number of places available or the length of the testing period. Companies interested in the track should check the National Data Governance Platform for the detailed conditions and selection criteria before applying.

What businesses may want to do: confirm whether the company is registered in the National Personal Data Protection Register, identify any product in development that relies on personal data, and assess whether supervised testing would help settle open compliance questions before the registration window closes.

Sources

• Saudi Press Agency: SDAIA Opens Registration for Personal Data Protection Track in Data Regulatory Sandbox

How Sokrab can help

• PDPL compliance for websites and marketing teams
• AI consulting: strategy and governance