On 6 October 2026, the Saudi Data and AI Authority (SDAIA) opened a public consultation on amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL). The window closed on 5 November 2026, according to Digital Policy Alert's record, which cites the Istitlaa public consultation platform as its source. One caveat up front: SDAIA's own pages blocked our automated fetches, and the Istitlaa consultation listing loads by script, so the provisions below come from law-firm analyses of the draft, not from the draft text itself.
What the draft would change
The headline item is a new Article 23(2) requiring controllers to "store personal data within the Kingdom." Transfers abroad would remain allowed under the PDPL and its regulations, according to Clyde & Co's summary, which notes that the current framework has no general storage requirement. Reed Smith flags that the wording is ambiguous. It may or may not require a local copy, and nothing in the draft as summarised says which.
The package goes well beyond localisation:
- Breach notification (Article 24): The "potential harm" threshold for notifying SDAIA would be removed, and notice would be due within 72 hours of awareness.
- Impact assessments (Article 25): New triggers would cover data about minors or people lacking legal capacity, large-scale or systematic monitoring, use of "emerging technologies" (undefined), and solely automated decisions affecting rights.
- DPOs and registration: SDAIA's separate DPO rules would be folded into the Regulation. Registration (Article 34) would extend to controllers whose core activities involve personal data, or who transfer data outside the Kingdom.
- Responsiveness (new Article 36): Organisations would have 20 business days to answer SDAIA requests.
If adopted, the amendments would take effect 60 days after Official Gazette publication, per both firms.
The strongest case for the mandate
Regulators have a serious argument. Enforcement is easier when data sits within reach of the regulator and the courts. A breach investigation or a data-subject request does not depend on a foreign provider's cooperation. For a state building national data infrastructure, a storage requirement also supports domestic cloud and data-centre investment. Children's data and automated decisions are fair places to demand more rigorous risk assessment. A rule that makes controllers think before processing a minor's data is hard to oppose.
Several of the non-localisation changes are defensible on those terms. A 72-hour breach clock matches what many modern regimes ask for, and a documented DPO appointment and a controller register give the regulator a map of who processes what.
Where the proportionality case breaks down
The problem is the storage mandate, and the way the draft sets up its triggers.
First, Saudi Arabia already has a transfer framework. PDPL Article 29 and the regulations on transfers outside the Kingdom set conditions and safeguards for cross-border movement, as Clyde & Co describes. If that framework works, a blanket storage rule adds friction without a clear gap it closes. If it does not work, the consultation should say what failed. Our fetches turned up no published SDAIA impact analysis for the storage proposal.
Second, the baseline is itself disputed. A US Commerce Department market-intelligence note describes existing rules as requiring companies to store sensitive and personal data in Saudi Arabia unless exempted. Clyde & Co says there is no general storage requirement today. Foreign businesses reading the same framework two ways is a sign that the rules are already unclear, and an ambiguous Article 23(2) would make that worse. Whether a mirrored local copy satisfies it is the difference between a manageable compliance task and a re-architecture of cloud deployments.
Third, open-ended triggers sit badly with an economy betting on AI. "Emerging technologies" is undefined. A trigger that sweeps in any processing using a new tool pushes firms toward blanket assessments, which slows adoption without improving privacy outcomes. Narrow triggers tied to concrete risk, such as profiling of minors or high-impact automated decisions, would target the harm. The draft also removes the "large-scale" qualifier for public-entity DPOs and for minors' data in the impact-assessment trigger. That is simpler to administer but applies the same burden to a school app and a national platform.
Fourth, removing the potential-harm threshold for notifying SDAIA means every incident, however trivial, reaches the regulator. Authorities that receive everything cannot prioritise. A harm-based threshold, with a clear definition and a short notification clock for serious incidents, is more useful to the regulator and the public.
What a better final text would look like
SDAIA can keep its enforcement goals and cut the cost. Four changes would do most of the work:
- Define "store" in Article 23(2) and state whether a local copy of data processed abroad satisfies it.
- Publish the cost-benefit reasoning for storage, and say what the existing transfer rules failed to deliver.
- Define "emerging technologies" or replace it with risk-based criteria.
- Restore a harm threshold for breach notification, with the 72-hour clock reserved for serious incidents.
Saudi Arabia has made AI and data central to its national economic planning, which is the reason legal certainty matters. Data-intensive investment follows predictable rules. A storage mandate with unclear edges, paired with undefined technology triggers, tells investors the opposite. Privacy protection is a legitimate goal, and a proportionate path to it exists. The final text, whenever SDAIA publishes it, is where that gets decided.