Saudi Arabia Proposes Major Data Protection Overhaul Impacting Global Firms
Saudi Arabia’s SDAIA proposes draft amendments to data protection law with new compliance rules.
Why it matters: Multinational companies must prepare for stricter Saudi data privacy standards that affect cross-border data handling and increase compliance risks.
- Saudi Data and Artificial Intelligence Authority (SDAIA) launched public consultation for PDPL amendments on Oct 6, 2026; ends Nov 5, 2026.
- Amendments require personal data to be stored in Saudi Arabia with restricted cross-border transfers compliant with PDPL.
- Data breach notifications must be submitted to SDAIA within 72 hours of discovery under the new rules.
- Controllers must respond to data subject rights within 30 days, extendable by another 30 days for complex requests.
- Marketing activities require consent verification and clear opt-out options, with Data Protection Officer designation mandatory for public entities and certain controllers.
- Non-compliance fines can reach SAR 5M (~USD 1.3M), doubled for repeat offenses.
On October 6, 2026, Saudi Arabia’s SDAIA issued draft amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL), opening them for public consultation until November 5, 2026.
The draft proposes significant regulatory changes that tighten data protection compliance across the Kingdom. Key among them is a mandatory data localization rule, requiring personal data to be stored domestically. Cross-border data transfers remain allowed but must align with PDPL requirements. This shift affects multinational companies operating within or with Saudi data subjects, creating new challenges for data governance and infrastructure.
The amendments also strengthen data breach notification protocols, mandating controllers to report breaches to SDAIA within 72 hours, a notable acceleration designed to improve incident responsiveness. Furthermore, data subject rights requests must be answered within 30 days, with a possible 30-day extension for requests deemed complex or voluminous.
Regulations on marketing practices become more rigorous, with controllers obliged to verify consent before processing data for promotional purposes and to provide straightforward opt-out mechanisms. Public sector bodies and certain private controllers will be required to assign a Data Protection Officer (DPO) and register with the National Register of Controllers.
Compliance stakes are high. The law sets fines up to SAR 5 million (~USD 1.3 million), which can double for repeat violations, underscoring SDAIA’s emphasis on enforcement. Legal experts note these amendments aim to clarify procedural standards without primarily targeting AI or technology sectors, broadening the general PDPL framework.
Given Saudi Arabia’s role as a key economic hub, these proposed changes impose a pressing need for legal counsel to reassess global data privacy strategies. Businesses reliant on data flows to and from Saudi Arabia must closely monitor the consultation outcome to adjust policies and technology accordingly.
By the numbers:
- 72 hours — timeframe for mandatory data breach notification to SDAIA
- 30 days — required response time for data subject rights requests, extendable by 30 days
- SAR 5 million (~USD 1.3 million) — maximum fine for data protection violations
What's next: The public consultation period closes November 5, 2026; final amendments are expected to be published thereafter.