PDPL Cross-Border Data Transfer: What AI Tools Mean

PDPL cross-border data transfer rules are easy to overlook when a team starts using an AI tool. A chatbot, an invoice reader or a writing assistant often runs on servers outside the Kingdom, and every customer name, phone number or document you send to it may count as personal data leaving Saudi Arabia. This guide is written for owners and managers of companies in Dammam, Khobar, Riyadh and Jeddah who want to know what the rules say and what to check before choosing a supplier. It is a business briefing, not legal advice.

PDPL cross-border data transfer: what the regulation says

The Personal Data Protection Law (PDPL) is supported by a separate SDAIA regulation on transferring personal data outside the Kingdom. According to the regulation published on SDAIA’s data protection portal, transfers are permitted when the destination country or organization gives a level of protection that SDAIA has judged adequate. SDAIA publishes the list of such destinations and reviews it every four years.

The regulation also allows transfers for other stated purposes, including central operational processing, providing a service or benefit to the person the data belongs to, and scientific research. A law firm briefing from King & Spalding (17 November 2025) adds that the regulation was issued in August 2024, and that the full list of approved destinations had not been published at the time. The Chambers 2026 guide repeats that point, so check SDAIA before you rely on any country being approved.

Safeguards: the three routes when a country is not approved

Where an exemption applies but the destination is not approved, the regulation requires an appropriate safeguard. It names three: standard contractual clauses, binding common rules for multinational groups, and accreditation certificates. SDAIA reviews the suitability of safeguards every two years or as needed.

King & Spalding explains that the standard contractual clauses come in four templates, depending on whether each side is a controller or a processor, and that binding common rules cover transfers inside a group, not transfers to an outside supplier. For most mid-sized companies, the contract with the AI vendor is therefore where the safeguard lives.

The risk assessment you may need first

Article 7 of the regulation requires a risk assessment before a transfer that relies on safeguards, and before transfers of sensitive data or large, continuous transfers. It must cover the purpose and legal basis, the nature and geographic scope of the processing, the safeguards, how data is limited to the minimum, and the likely harm and how to reduce it.

SDAIA’s Risk Assessment Guideline followed in February 2025. Clyde & Co (18 March 2025) notes that the guideline is not legally binding but is a key reference, and that it sets out four phases from preparation to a check that the transfer does not harm national security, economic stability or the public interest. Two further rules matter: the same conditions apply to onward transfers by the recipient, and a company must stop the transfer if its safeguards fail.

Why AI tools are a special case

The Chambers guide says there is no separate AI law, and the PDPL applies whenever AI systems train, tune or infer from personal data. It also states that remote access to data from abroad counts as a transfer, and that sector rules, such as those for health or finance, can restrict where data is processed. The guide notes that organizations generally apply the strictest rule that fits.

Put these points together and the practical reading is cautious. If your WhatsApp assistant, document reader or reporting tool sends personal data to a service hosted abroad, or lets a foreign supplier’s staff see it, treat it as a transfer and ask your legal adviser to confirm. The same applies if a supplier uses your data to train its models.

What it costs to get this wrong

The Chambers guide reports that the PDPL came into force on 14 September 2023 and moved into active enforcement on 14 September 2024. Administrative fines can reach SAR 5 million and may be doubled for repeat violations. Other measures include warnings, orders to suspend or restrict processing, and publication of the decision at the violator’s expense.

A six-step check before you buy an AI tool

• List the personal data the tool will receive: names, phone numbers, national IDs, health or financial details, and which of these are sensitive.
• Ask the supplier where the data is processed and stored, and whether anyone outside the Kingdom can access it, including for support.
• Ask which safeguard covers the transfer, and ask to see the contract clauses in writing.
• Ask whether your data is used to train the supplier’s models, and whether you can switch that off.
• Complete a written risk assessment if your transfer relies on safeguards or involves sensitive or large-scale data.
• Send only the data the task needs, and review the set-up every year or when the supplier changes its hosting.

Where to start

You cannot answer these questions without a clear picture of how data moves between your systems and your AI tools. Our AI Architecture Audit maps that flow and shows where personal data leaves your control. Our document processing automation solution can be set up to keep data in the Kingdom where required, and our AI Integration service connects the result to your current systems. For the wider compliance picture, read our post on PDPL compliance and the 48 SDAIA decisions. To discuss your own case, book a free discovery call with Scalor Systems at scalorsystems.com/contact.

Sources

1. SDAIA: Regulation on Personal Data Transfer outside the Kingdom (SDAIA data protection portal)
2. King & Spalding: International Personal Data Transfers under Saudi Arabia’s Data Protection Law (17 November 2025)
3. Clyde & Co: Update on Saudi Arabia’s cross border data transfers, the new Risk Assessment Guidelines (18 March 2025)
4. Chambers and Partners: Data Protection & Privacy 2026, Saudi Arabia (GLA & Company)