SDAIA · PDPL
What the draft PDPL amendments would change for anyone running AI
Regulatory Briefing · 30 October 2026 · Reviewed on 30 October 2026 · 13 min read
Dr. Marion S.
Founder, Oxon X · PhD in computer science, University of Oxford · Paris Bar–qualified
SDAIA published draft amendments to the Implementing Regulation of the Personal Data Protection Law on 6 October 2026. Comments close on 5 November. If they are adopted, the Regulation enters into force sixty days after publication in the Official Gazette.
For anyone running AI on personal data, the draft does two things at once, and they point in opposite directions. It widens the net. Processing with any emerging technology, and processing that produces decisions based on automated processing that affect rights or interests, would each trigger a written impact assessment on their own, with no threshold of scale attached. And it thins the document. The assessment's required contents would fall from eight elements to seven, and the one that does the most work — severity assessed materially and morally, with psychological, social, physical and financial harm each weighed for likelihood — would be replaced by a single line about potential risks and resulting impacts.
More systems caught. Less asked of each file.
Alongside that, personal data would have to be stored in the Kingdom, and transferring it abroad would on its own require registration in the National Register. None of this is law yet. What follows is what the draft says, read against the text it would replace.
One. Two new triggers, neither of them qualified by scale
Article 25(1) of the Regulation today lists four cases in which a written impact assessment must be prepared. Three of them stand on their own: case (a), sensitive data; case (b), the linking of datasets from different sources; and case (d), a product or service whose processing is likely to cause serious harm to privacy. Case (c) is different. It gathers four situations behind a single qualifier: the controller's activity must involve, on a large scale or on a repeated basis — على نطاق واسع أو بصورة متكررة, which the official English translation of the Regulation renders "continuous and large scale" — the processing of data of those lacking legal capacity, or operations requiring constant monitoring, or the use of emerging technologies, or decisions based on automated processing.
The draft takes case (c) apart. In its place, Article 25(1) would list five cases, lettered afresh. The right-hand column is what else must be true before a case applies at all — the threshold the text in force attaches to most of them:
| Case | Proposed trigger | Threshold |
|---|---|---|
| a | Sensitive data, or personal data relating to minors or people with partial or no legal capacity | None — any scale, any frequency |
| b | Collecting, comparing or linking two or more datasets from different sources | None — any scale, any frequency |
| c | Processing carried out on a large scale, or involving by its nature regular or systematic monitoring | Large scale, or regular or systematic monitoring |
| d | Processing using any emerging technologies | None — any scale, any frequency |
| e | Processing that will result in decisions based on automated processing that affect the rights or interests of data subjects | None — any scale, any frequency |
Two of these reach AI directly, and neither carries a threshold. A system using an emerging technology would trigger an assessment whether it runs once or continuously, for ten people or ten million. So would a system producing decisions made by machine, provided those decisions affect rights or interests. On that last trigger the two published versions of the draft do not say the same thing. The English reads "decisions based solely on automated processing". The Arabic reads قرارات مبنية على معالجة آلية تؤثر على حقوق أو مصالح أصحاب البيانات الشخصية — decisions based on automated processing that affect the rights or interests of data subjects — with no word corresponding to solely. And that is not a slip of translation. The same formulation appears in draft Article 11(2)(c), which governs when explicit consent is required, and there the deletion is visible on the face of the comparison. The provision in force reads قرارات مبنية بشكل كامل على المعالجة الآلية — decisions based entirely on automated processing. The draft strikes بشكل كامل out and adds, in its place, that the decision must affect the rights or interests of data subjects. The English of the same draft puts solely back into both provisions. Read on the Arabic, the Kingdom would stop regulating only the decision taken without a person, and begin regulating any decision built on automated processing that affects rights or interests. For an organisation that has placed a human in the loop and considered the question settled, that is the question reopened. The Arabic governs. At least one respondent to the consultation has read it the same way, welcoming the removal of the requirement that the decision be wholly automated and asking SDAIA to say when a decision counts as based on automated processing — proposing that it does wherever the system's output is decisive or a substantial factor, including where a member of staff adopts that output without real authority to review and change it.
A case also disappears. Case (d) in force — a product or service whose processing is likely to cause serious harm to privacy — has no equivalent in the new list, and that case did particular work. Article 22 of the Law, which is the provision the whole of Article 25 exists to implement, attaches the duty to any product or service تقدم للعموم — offered to the public — and case (d) was the only one phrased in those terms. Remove it, and every remaining case turns on a category of data or a method of processing; none turns on a product or service offered to the public. Two readings follow, and the draft does not choose between them. Either the five cases are the complete implementation of Article 22, in which case a public-facing product falling outside all five would owe no assessment. Or Article 22 continues to apply on its own terms, in which case controllers would owe an assessment the Regulation no longer lists.
Two. Eight required elements become seven, and the one that does the work is gone
The law-firm commentary published so far passes over it. The consultation record does not: a respondent has already asked that necessity, proportionality, and the likelihood and severity of risk be kept in the minimum content of an assessment. It matters more than the triggers.
Article 25(2) today requires an assessment to contain at least eight elements. Two of them are the ones a generic template does not produce: the necessity and proportionality of the measures enabling the controller to process the minimum data needed; and the impact of the processing, based on the severity of its impact materially and morally, and the likelihood of any negative impact on data subjects, including any psychological, social, physical or financial impact, and the likelihood of their occurrence.
In the draft, the first is deleted outright. The second is replaced by: the potential risks of the processing and the resulting impacts, whether material or non-material.
What goes with it is the enumeration — psychological, social, physical, financial — and the express requirement to weigh likelihood. What remains is a sentence that most European risk sections already satisfy.
The closing duty shifts too. Today, Article 25(4) requires the controller to address the causes and re-conduct the assessment where it indicates the processing will harm data subjects' privacy. In the draft, the trigger becomes a finding that the activities and measures are not appropriate, upon which the controller must reassess. The test moves from harm to the person, to adequacy of the measures.
Three. Personal data would have to be stored in the Kingdom
Draft Article 23(2) reads, in full: The Controller shall store Personal Data within the Kingdom. Personal Data may be transferred or disclosed outside the Kingdom in accordance with the provisions of the Law and its Implementing Regulation.
Two sentences, and the second does not say what the first means. For an organisation running AI, the question is what the first reaches: a model hosted abroad, an inference call to a foreign endpoint, a vector store in another region, a managed service whose support team sits outside the Kingdom. Each is a place where personal data comes to rest or passes through, and each would have to be read against a storage requirement rather than only against the transfer rules. A respondent to the consultation has put one case of it directly: whether sending personal data in a request to a model hosted abroad should count as a transfer even where the provider states it retains nothing, since the data has still left the Kingdom and been processed outside it.
Four. A transfer abroad would be enough to require registration, and individuals are in scope
Draft Article 34 moves the National Register rules into the Regulation and sets four conditions, any one of which requires registration: the controller is a public entity; its core activity requires processing personal data; it processes sensitive data or data of people lacking legal capacity; or it transfers personal data outside the Kingdom or discloses it to entities outside the Kingdom.
The fourth is new in effect. An organisation whose core activity has nothing to do with personal data, and which handles no sensitive data, would still have to register if it sends data abroad — which, for anyone calling a model hosted elsewhere, is the ordinary case.
A third paragraph goes further still: the obligation would apply to a natural person where they process personal data for purposes beyond personal or family use.
The rest, in short
| Provision | What the draft would do |
|---|---|
| Breach notification — Art. 24(1) | Notification within 72 hours would be owed on a personal data breach, damage, or unauthorised access, with the condition that the incident potentially causes harm removed altogether |
| The definition of a breach — Art. 1 | Deleted, with a note that the deletion requires editing every affected text. Article 24 continues to use the term |
| Data protection officers — Art. 32 | A public entity providing services involving processing would have to appoint one, with the words "on a large scale" removed from that limb and attached instead to the monitoring limb. The DPO's contact details must be filed through the Competent Authority's Platform and kept current. The separate DPO Appointment Rules are repealed into the Regulation |
| Records of processing — Art. 33 | Kept for the duration of the processing and five years after each activity ends, as today. The list of minimum contents — purposes, categories, retention periods, recipients, transfers and their legal basis, security measures — is removed from the Regulation |
| Responding to the authority — Art. 36 (Repeated), new | Twenty business days from receipt. An extension must be requested with sufficient justification and is granted at the authority's discretion |
| Data subject requests — Art. 3 | Thirty days, extendable by thirty. A request not fulfilled within the period would be deemed rejected, and the data subject may complain to the authority |
| Explicit consent — Art. 11(2)(c) | The Arabic deletes the words requiring the decision to be based entirely on automated processing, and adds that it must affect the rights or interests of data subjects. The English of the draft keeps "solely". See section One |
| Privacy policies — Art. 18 (Repeated), new | Clear and simplified language, consistent with the language customarily used for providing the services or products concerned. The Arabic adds a third subparagraph the English version of the draft does not contain: the policy may be published in more than one language, provided that Arabic is one of them |
| Security — Art. 23(1) | Reframed around preventing leakage, damage and unauthorised access. NCA controls where applicable; otherwise recognised cybersecurity standards and best practices |
| Marketing — Arts 28 and 29 | Consent before sending promotional or awareness material, with evidence of it retained, opt-out at least as easy as opt-in and free of charge, and destruction of the resulting data on withdrawal |
| Complaints — Art. 37 | The ninety-day filing limit is removed |
| Accreditation licensing — Art. 35 | Removed entirely |
| Entry into force — Art. 38 | Sixty days after publication in the Official Gazette |
Four things the draft does not settle
What "store in the Kingdom" means alongside a lawful transfer. Article 23(2) requires storage inside Saudi Arabia and then permits transfer and disclosure outside it, without saying how the two sit together. Read one way, a copy must remain in the Kingdom whatever else is done with the data. Read another, storage is a default that gives way where a lawful transfer is made. The difference is the difference between re-architecting a system and documenting it.
What counts as an emerging technology. The term is not defined, and has not been since it entered the Regulation. Read narrowly it means the frontier; read broadly it means anything the organisation has not used before. The draft turns it into a standalone trigger, so the undefined term now decides, on its own, whether an assessment is owed.
Whether less content is meant. Removing necessity and proportionality, and compressing severity and likelihood into one line, may be simplification or may be a deliberate lowering. The published draft gives no reasons, and the question is worth asking while the consultation is open, particularly for processing where the harm is psychological or social rather than financial, which is where the deleted enumeration did its work.
A definition deleted but still in use. Article 1's definition of a personal data breach is removed, with a note that the removal requires editing every affected text. Article 24 continues to use the term. That reads as a drafting matter rather than a policy choice, but until it is corrected, the notification trigger rests on a term the Regulation no longer defines.
What can be done before it lands
Sixty days after publication is not long for work that touches where data lives. Three things can be done now, and none is wasted if the draft changes.
Find out where personal data actually comes to rest. Not the systems the business declares, but the ones the systems use: hosting regions, model endpoints, vector stores, backups, and the places support staff work from. A storage requirement can only be answered against a map that exists, and a registration obligation triggered by transfer can only be answered by knowing which transfers occur.
Write the assessment to the current Article 25(2), not to the draft. The eight elements are in force today, and an assessment that answers them answers the seven as well. One that answers only the seven would not answer the eight. Working to the stricter text costs nothing and is already owed.
Respond to the consultation. It closes on 5 November 2026. Three points are worth making, and the comments already published show that none of them is eccentric: that an undefined term should not decide, on its own, whether an assessment is owed; that the deleted enumeration of psychological, social, physical and financial harm did work the replacement wording does not obviously do; and that the English and Arabic of the automated-decision trigger do not currently say the same thing.
This note reads the draft published for consultation against the Regulation it would replace. It is not law and it may change. It is general commentary, not advice on any organisation's position. Provisions in force are taken from the Arabic texts of the Law and of the Implementing Regulation published by SDAIA, which govern; where the official English translation differs from the Arabic on a point that matters, this note says so.
Source: SDAIA, "Proposed Amendments to the Implementing Regulation of the Personal Data Protection Law", draft for public consultation, published 6 October 2026 on the Istitlaa platform.