What the law already requires of you.
The law binds every organisation processing personal data in the Kingdom. SDAIA has been issuing decisions since 2025. What follows is what the law requires, the questions a file has to survive, and where to start.
What the law requires today
Records of processing
Every processing activity recorded, including what the AI consumes and produces, with the sources it was collected from and the parties it reaches.
Impact assessment — Article 22 PDPL, Article 25 of the Regulations
Written, one per product or service, with the eight elements Article 25 requires, including the severity and likelihood of financial, social, physical and psychological impact.
Cross-border transfer — Article 29 PDPL
Every flow mapped to a lawful basis, the correct SDAIA standard clauses unmodified, and a documented transfer risk assessment.
Automated decisions — Articles 4(5) and 11(2) of the Regulations
Explicit consent where a decision rests solely on automated processing, and a clear statement to the person that it does.
Breach and records
Notification to SDAIA within seventy-two hours, with an incident procedure that has been tested rather than written.
Health data and devices — Article 26 PDPL, SFDA MDS-G-027
Specific measures, every stage documented, a named person accountable at each; and where the AI is a regulated device, SFDA guidance adds change management and human oversight.
Fines reach five million riyals per violation. SDAIA has issued decisions for marketing without consent, breaches not notified within seventy-two hours, requests not answered in time, missing safeguards, and no data protection officer where one is required.
Six questions a file has to survive
Does the assessment answer all eight elements?
Article 25 asks for the impact materially and morally — psychological, social, physical and financial harm, each weighed for likelihood — and, separately, a judgement on whether the measures envisaged are suitable. A four-heading European model does not reach that.
Does the record go past the systems everyone knows about?
The CRM and the HR system are the easy part. The exports, the shared drives, and what an AI consumes and produces are where a record stops being complete.
Does the register show the transfers your systems make, or only the ones the business declared?
Hosting, sub-processors, overseas support access, and the calls an AI makes to a model you do not host.
Has it been established who actually decides the means of processing?
The contract says one thing and the system does another — most sharply where a supplier sets parameters you do not control.
Can the person who signs off see inside the decision, and reverse it?
A decision signed off is not a decision made.
Has the breach procedure been tested, or only written?
Seventy-two hours is short, and the first rehearsal should not be the breach.
Where to start
An assessment, not legal advice and not a certification. We examine documents, technical records and the system in operation, and report what each obligation is evidenced by.
Start with a conversation.
Tell us what you process and where the AI sits. We reply with a scope and next steps within two business days.
Request an assessmentEvery engagement is an assessment: we examine documents, technical records and the system in operation, and report findings and gaps. It is not legal advice, not a certification and not an accreditation, and it does not replace a formal legal opinion. Saudi law matters are handled with locally licensed counsel. Scope and price are agreed in writing before any work begins.