PDPL Draft Amendments 2026: What Saudi Firms Should Check

The PDPL draft amendments published this month could change how Saudi companies store customer data and how they use AI tools. The Saudi Data and AI Authority (SDAIA) has opened a public consultation on changes to the Implementing Regulations of the Personal Data Protection Law (PDPL). This guide is written for owners and managers in Dammam, Khobar, Riyadh and Jeddah who hold customer, patient, tenant or student data and want to know what to check before the consultation closes on 5 November 2026. It is a business briefing, not legal advice.

PDPL draft amendments: what SDAIA has published

According to law firm Clyde & Co, in an article dated 8 October 2026, SDAIA published draft amendments to the Implementing Regulations for public consultation. Comments run from 6 October to 5 November 2026 on the Istitlaa public consultation platform. If the amendments are adopted, they would take effect 60 days after publication in the Official Gazette. Al Tamimi & Company confirms the 5 November closing date.

For context, the PDPL entered into force on 14 September 2023, and its one-year grace period ended on 14 September 2024. We could not open the draft text on Istitlaa, so everything below comes from law-firm summaries. Check the official draft before you act on any detail.

Data localisation: storing personal data in the Kingdom

The change most likely to affect your tools is a proposed Article 23. Clyde & Co reports that controllers would have to store personal data within Saudi Arabia, while transfers and disclosures abroad would remain possible under the PDPL and its regulations. Today there is no general storage requirement. A commentary by consultant Aziz Al Khunizan reads this as making local storage the default and offshore transfers the exception that needs a lawful basis. He notes that SDAIA’s practical interpretation is not yet settled.

This matters for AI. A chatbot, an invoice reader or a support tool often sends customer data to a service hosted abroad, and also keeps logs, backups and analytics there. The current transfer rules already ask for safeguards. SDAIA’s Regulation on Personal Data Transfer outside the Kingdom requires a risk assessment before transfers of sensitive data or continuous or large-scale transfers. Our earlier post on PDPL cross-border data transfer and AI tools covers those rules.

Other proposed changes that touch daily operations

• Breach notification (Article 24): notice to SDAIA within 72 hours of becoming aware of any breach or unauthorised access, without today’s harm threshold. Notice to individuals would keep the damage-based test.
• Impact assessments (Article 25): new triggers include use of emerging technologies and processing that produces automated decisions affecting people’s rights or interests. This is the only AI-related item in Clyde & Co’s summary.
• Controller registration (Article 34): mandatory on the National Register of Controllers for several groups, including controllers that transfer or disclose data outside the Kingdom.
• Data protection officers: required in more cases, with documented appointments and contact details given to SDAIA.
• Response times: 20 business days to answer an SDAIA request, and a data subject request would be treated as rejected if you miss the 30-day deadline, which would let the person complain to SDAIA.
• Marketing and privacy policies: evidence of consent and an easy way to withdraw it, and notices in clear language suited to the audience, which Clyde & Co says would likely mean Arabic for most firms.

A six-step PDPL check before 5 November

• List every system that holds personal data, and every AI tool that receives it, including email, backups, logs and analytics.
• For each one, note where the data is stored and processed: inside the Kingdom, abroad, or unknown. Ask vendors to confirm in writing.
• Mark each flow that leaves the Kingdom and write down the lawful basis and safeguards you rely on today.
• Test your incident process: could you send a notice within 72 hours, and who decides? Name a back-up for holidays.
• Name one person to receive SDAIA requests and data subject requests, and check that your privacy notice and consent records are in Arabic and easy to find.
• If your business has a strong view, send comments through Istitlaa before the deadline. Industry feedback is the point of a consultation.

What this means for your AI projects

None of this stops you from using AI. It means that where an AI tool runs, and what it stores, becomes a design choice from day one. Our AI Architecture Audit maps your data flows and shows which tools could stay as they are and which need a different hosting or contract set-up. If you already run a customer-facing assistant, our AI customer service agents solution can be configured with these questions in mind. To talk through your own systems, book a free discovery call with Scalor Systems at scalorsystems.com/contact.

Sources

1. SDAIA: Regulation on Personal Data Transfer outside the Kingdom (SDAIA data protection portal)
2. Clyde & Co: The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL (8 October 2026)
3. Al Tamimi & Company: SDAIA opens public consultation on proposed amendments to the PDPL Implementing Regulation (9 October 2026)
4. Aziz Al Khunizan: Saudi Arabia’s PDPL draft would make local storage the default (10 October 2026)