Saudi PDPL and AI systems: what the Implementing Regulation asks of a controller

Saudi Arabia’s Personal Data Protection Law, نظام حماية البيانات الشخصية, is a general data-protection statute, issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H [2]. Neither the Law nor the Implementing Regulation that SDAIA issued under it uses the words artificial intelligence [1, 2]. Read them as an AI team would, though, and the regulation’s triggers describe what an AI system in production does: it links personal data from different sources, and it relies on newly adopted technologies and decisions based on automated processing, on a large scale or repeatedly [2, 10].

It also reaches further than people expect. Article 2 of the Law covers any processing of personal data in the Kingdom, and processing of personal data about individuals residing in the Kingdom by any party outside it [1]. A UK or US company running a model for Saudi customers is inside the Law wherever that model runs. SDAIA is the competent authority, as its own rules state [4, 5], and the Law leaves the powers of the Saudi Central Bank where they were [1].

The penalties are set in the Law itself. A violation of the Law or the regulations can bring a warning or a fine of up to five million riyals, which may be doubled for a repeat. Disclosing or publishing sensitive data with intent to harm someone or for personal benefit carries up to two years in prison, a fine of up to three million riyals, or both, and anyone harmed by a violation can go to court for compensation [1].

Public bodies are controllers like everyone else. The Law defines a public entity as any ministry, department, public institution or public authority [1], and several of the duties below name public entities directly.

Here is the regulation read the way an AI team has to read it. The first column is where each duty sits. The second is my reading of what it asks of an AI system. The third is the artefact that shows the duty was met, which is what a data protection officer, an auditor or SDAIA will ask to see.

The first column is from the Law [1], the Implementing Regulation [2] and SDAIA’s rules [4, 5]. Two duties do not fit in a table row. Data minimisation is written partly as a documentation duty: the regulation asks for data maps that link each item of personal data to the purpose it serves [2], which for an AI system means knowing which fields reach the prompt. And destruction reaches copies, because Article 8 asks for every copy in the controller’s systems to be destroyed, backups included [2].

The middle column is my reading, not SDAIA’s, and this page is not legal advice.

Article 25 lists four situations in which a controller must write down an assessment of the impacts and risks for the people whose data it processes, and any one of them is enough [2].

The qualifier sits between dashes straight after “includes”, so it reads most naturally as covering all four kinds of activity in that clause, not only the first. The Arabic text reads “على نطاق واسع أو بصورة متكررة”, on a large scale or repeatedly, where the English version says large scale and repetitive [2, 10]. Where the two differ, I work from the Arabic. In practice, a production AI system that runs every day on customer data will usually meet “repeatedly”, and a one-off pilot may not. The sensitive-data and linked-datasets triggers carry no such qualifier, which is why a typical retrieval system is caught either way.

Put a language model in front of customer data in 2026 and I would not try to argue it is anything other than a newly adopted technology. Look closely at the wording on decisions, too. Article 25 says decisions based on automated processing, without the word “solely” that Articles 4 and 11 use [2]. A person reviewing every output may change your notice and consent position. On my reading it does not take you out of the assessment.

The assessment has eight minimum parts: the purpose and legal basis, the nature of the processing, its scope, its context, necessity and proportionality, the impact on people and its likelihood, the measures to prevent or reduce the risks, and whether those measures are enough [2]. The controller gives a copy to any processor acting for it, and if the assessment shows the processing will harm people’s privacy, the controller addresses the causes and does the assessment again [2]. SDAIA’s National Data Governance Platform lists an impact assessment service [5, 9].

A private-sector controller that relies on legitimate interest rather than consent has a second assessment to write first, because Article 16 asks for a documented balancing test before that processing starts, and the basis is not available for sensitive data or to a public entity [2]. Before either document, it helps to score each AI use case before it is built, so the effort goes to the ones that carry the most risk.

Two provisions turn on whether a decision is made solely by automated processing. Article 4 requires a controller whose activities include new technologies or automated decisions, on a large scale or repeatedly in the Arabic text, to tell people whether decisions will be made that way [2, 10], and Article 11 requires their consent to be explicit when they are and consent is the basis [2].

The regulation does not define “solely”. My reading is that a person who sees the inputs, has the time to disagree and can change the outcome takes a decision out of that category, while a reviewer who approves every output without the information to challenge it probably does not. That is a design choice as much as a legal one: the review screen, the override button and the log of how often reviewers actually override. Confirm the reading with your own counsel before a system depends on it.

For public bodies the questions are different, not lighter. A public entity cannot rely on legitimate interest [2]. When it collects data other than directly from the person, reuses it for another purpose or asks for it to be disclosed in the public interest, Article 21 asks it to show the public interest is clearly defined and within its legal mandate, to limit the harm, to keep to the minimum data and to record the processing in its records [2]. A ministry piloting an assistant on case files should expect all of that, plus registration, which every public entity needs, and an officer if it provides services that process personal data at scale [4, 5].

Health and credit data carry extra rules inside the regulation itself. Article 26 requires controllers processing health data to adopt the requirements of the Ministry of Health, the Saudi Health Council, the Saudi Central Bank and the Council of Health Insurance, to document every stage of processing with a named person in charge, and to put the same duties into their processor contracts [2]. Article 27 does the same for credit data against the Saudi Central Bank’s requirements and the Credit Information Law [2]. A bank or an insurer reads the PDPL alongside its sector regulator, never instead of it.

Sending personal data to a model hosted outside the Kingdom is a transfer. SDAIA’s Regulation on Personal Data Transfer outside the Kingdom, version 2.0 of August 2024, sets out three safeguards (standard contractual clauses, binding common rules and a certificate of accreditation) and requires a risk assessment before a transfer that relies on them, or one that moves sensitive data continuously or on a wide scale [3]. Which region actually runs the model is a separate question, and our guide to Gulf AI data residency sets out what to ask a cloud or model vendor about it.

SDAIA also publishes AI Ethics Principles, which on their own text apply to everyone designing, developing, deploying or using AI systems in the Kingdom [7]. They grade AI systems by risk: systems posing high risk to basic rights “must undergo pre- and post-conformity assessments”, and systems posing an unacceptable risk, such as social profiling, are not allowed [7]. Registration under them is optional [7]. The same SDAIA page lists generative AI guidelines for government and for the public [8], and the National Data Governance Platform’s menu, read in Arabic, lists an AI ethics assessment beside the personal data services [9].

This is the order I would work in for one use case with a named owner. It is a plan built from the regulation, not a timetable SDAIA sets, and a controller with no register entry, no officer and no records at all has that work to do first.

Thirty days is realistic when the owner can make decisions and the data sources are known. It is not realistic when nobody can say which systems hold personal data, and in that case the map is the project.

The work on this page is what we sell as AI governance implementation: the impact assessment, the records and the logging built into the system they describe, so the evidence comes from the system rather than from a document written beside it. We work with clients across the UK, the US and the Gulf. We have built Arabic-language AI, including bilingual Arabic and English search and Arabic document OCR, which matters here because a Saudi system often reads personal data written in Arabic.

Our closest published work in the region is the production estate of a government-accredited EdTech in the Middle East, whose database we replatformed into Google Cloud’s Doha region, me-central1, to meet Gulf data-residency requirements. That was a Qatar-region decision rather than a Saudi one, and I mention it for the method: every store with a named region, and the evidence written down. Once a scope is signed, a fixed-scope build can start within a day, and if you already have a scoped job, we can resource it on contract from the collective of associates who work with us, held to the same standard. Whether the result satisfies SDAIA stays with your officer and your counsel. The call is booked from the end of this page.