Key takeaways
- SDAIA opened a consultation on amendments to the PDPL Implementing Regulation on 6 October 2026. It closes on 5 November 2026.
- Controllers would have to store personal data inside Saudi Arabia, though transfers abroad would still be allowed under the existing rules.
- Breaches would be reportable to SDAIA within 72 hours whether or not harm is likely, and AI-style “emerging technologies” would trigger a DPIA.
- If adopted, the changes take effect 60 days after publication in the Official Gazette, so there’s limited time to adjust hosting, chatbots and automations.
What SDAIA has actually proposed
This is a draft, not a final rule. The Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation on 6 October 2026 on amendments to the Implementing Regulation of the Personal Data Protection Law (PDPL), according to Clyde & Co. Comments go through the Istitlaa public consultation platform and close on 5 November.
The PDPL itself has been enforceable since the grace period ended on 14 September 2024. What’s changing is the detailed rulebook underneath it. Pinsent Masons, in an analysis published on 19 October, calls the storage requirement “one of the most consequential amendments” in the package.
This isn’t legal advice. We’re summarising law firm commentary on a draft that may change before it’s adopted. If you process personal data of people in Saudi Arabia, talk to qualified Saudi counsel about your own situation.
The changes most likely to touch your AI projects
Here’s how the main proposals line up against the tools businesses are actually building, based on the Clyde & Co, Pinsent Masons and Al Tamimi & Company summaries.
| Proposed change | Where AI and automation feel it |
|---|---|
| Controllers must store personal data within the Kingdom; transfers abroad still permitted under the PDPL | Chatbot logs, CRM records and vector databases hosted only in overseas cloud regions |
| Breach notice to SDAIA within 72 hours, with the likely-harm threshold removed | Minor incidents in automations, such as a misrouted email, could become reportable |
| DPIA required for emerging technologies, large-scale or systematic monitoring, and automated decisions affecting people’s rights or interests | New AI agents, scoring models and customer-facing assistants |
| Registration with the National Register of Controllers if you transfer or disclose personal data outside KSA | Using a foreign AI model provider or SaaS tool to process Saudi customer data |
| Processing records kept for the life of the activity plus five years | Logs and audit trails from AI workflows |
| Responses to SDAIA requests due within 20 business days | You’ll need to explain quickly how a model or workflow handles data |
The draft doesn’t define “emerging technologies”. Pinsent Masons says the term is “likely to capture technologies such as artificial intelligence”, which is our reading too. Al Tamimi also notes that extra safeguards on automated processing would apply where it affects people’s rights or interests, not only where a decision is made solely by a machine. That’s a wider net than many teams assume.
Data storage is the hard one
Most small and mid-sized businesses running AI in the Gulf use cloud services hosted somewhere else. A website assistant might keep conversation history in Europe, push leads into a US-hosted CRM and call a model API in yet another region. Under the draft, the personal data in that chain would need to be stored in Saudi Arabia, even if transfers out stay lawful.
Pinsent Masons points out that the draft “separates the concepts of ‘storage’ and ‘transfer'”, and that it’s unclear whether holding a copy in the Kingdom is enough. Backups and replicated databases raise the same question. Until SDAIA clarifies, we’d treat this as a design question rather than a paperwork one: know where every copy of customer data lives.
Marketing, customer requests and chatbots
Two smaller changes matter for anyone using AI in sales or support. First, marketing would need verified consent where you rely on a prior relationship, kept evidence of that consent, and an easy way to opt out. When someone withdraws, Clyde & Co says you’d have to stop the processing and destroy data generated by it “without undue delay”. That includes lead scores and segments your automation built.
Second, the 30-day window for data subject requests stays, but an unanswered request would be deemed rejected and the person could complain to SDAIA. If your AI chatbot collects names and phone numbers, you need a way to find and delete that data on request. The same applies to WhatsApp assistants; our piece on WhatsApp chatbot policy covers the platform side.
What to do before and after 5 November
- Map your data. List every AI tool, automation and chatbot that touches Saudi personal data, and where each one stores it, including logs and backups.
- Decide whether to comment. If localisation would break a core product, the consultation is the moment to say so, through counsel or an industry body.
- Run a DPIA on your highest-risk AI use now. If the draft is adopted, you’ll likely need one anyway, and the 60-day runway is short.
- Tighten breach handling. With no harm threshold, small incidents may need reporting, so make sure alerts from your automations reach someone who can act within 72 hours.
- Check consent and deletion in your marketing flows, including data your AI tools derived from it.
If you’re also selling into Europe, the obligations stack rather than replace each other. Our guide to the EU AI Act delay covers that side.
Our view
The direction is clear even if the details aren’t final. Saudi Arabia wants more control over where data sits and more visibility into incidents, and AI is squarely in scope. Building data residency and audit logging into an AI project from day one costs far less than retrofitting it once a regulator asks.
If you’re planning AI agents or automation for customers in Saudi Arabia or the wider Gulf, our AI strategy consulting work starts with exactly this kind of data map. You can see how we approach the region on our Gulf automation page or book a strategy call.
Frequently asked questions
Are the PDPL amendments in force yet?
Does the draft ban sending personal data outside Saudi Arabia?
Will AI tools need a data protection impact assessment?
What changes for data breaches?
Sources
- Clyde & Co: The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL
- Pinsent Masons Out-Law: Saudi consultation proposes data protection reform
- Al Tamimi & Company: SDAIA opens public consultation on proposed amendments to the PDPL Implementing Regulation