What changed
On 26 October 2026, Saudi Arabia's Ministry of Interior launched "Absher Travel for Visitors", a service inside the Absher app for GCC nationals and other visitors entering by land. Arab News reported that the aim is to streamline entry at the Kingdom's land borders. The same report says the service becomes mandatory within six months of launch, which points to roughly late April 2027.
Travellers enter their nationality, mobile number, travel document, crossing and expected travel date. They then add traveller, vehicle and insurance details. ID Tech Wire reports that the ministry issues a Visitor ID, which can be verified through Absher and Nafath, the national single sign-on service. Arab News lists the participating bodies: the ministries of foreign affairs and tourism, the Saudi Data and Artificial Intelligence Authority (SDAIA), the Zakat, Tax and Customs Authority, the Communications, Space and Technology Commission, the Insurance Authority, the General Directorate of Passports and Public Security.
The Visitor ID also already works outside the border context. On 28 September 2025 the Saudi Central Bank (SAMA) announced that banks in the Kingdom may use it to open accounts. SAMA says the ID is issued by the Ministry of Interior and can be verified through authorized digital platforms, and it presents the change as supporting financial inclusion.
The strongest case for the service
The case for the reform is real. Land crossings are where paperwork piles up: vehicles, insurance, passports and customs all meet at one gate. Collecting the data before arrival moves that work off the roadside. It lets agencies check records ahead of time and gives honest travellers a predictable process. A single verifiable ID that several agencies and banks can check is also more secure than a paper form or a photocopied passport. For the millions of GCC residents and visitors who cross by road, this is sensible service design. The financial-inclusion rationale SAMA gives is also credible: a visitor on a legitimate visa gets access to ordinary banking without a local sponsor.
This is the pro-innovation side of digital identity. Government-run, interoperable credentials cut costs and fraud, and they make cross-border trade and tourism easier.
Where proportionality is still open
Three design features deserve scrutiny, because they decide whether this stays a convenience or becomes a general-purpose tracking layer.
1. Mandatory means no opt-out. Voluntary pre-registration is a convenience. Once it is compulsory, the quality of the data protections is no longer optional for the traveller either. A visitor cannot decline the data collection without declining the trip. The fields collected, such as phone number, vehicle details and expected travel date, are reasonable for border control. They are also exactly the fields that build a movement history if they are kept indefinitely.
2. One credential, many uses. The Visitor ID began as an entry document. Since September 2025 it also opens bank accounts, and it is verified through Nafath, a login service. Function creep is not inherently bad: reusing a trusted credential is the whole point of digital identity. But each new use widens the set of parties who can see that an ID was checked, and when. Neither the Ministry of Interior nor SAMA has published, in the material I could review, a retention period or a rule on whether border data may be linked to banking records.
3. The overseer is also a participant. SDAIA is listed among the partners in the new service. SDAIA also runs the National Data Governance Platform, which presents the Personal Data Protection Law (PDPL) as the framework for protecting individuals' personal data and dates the law's issuance to 16 September 2021. An authority that helps build a system can still regulate it. But when the regulator is also a delivery partner, public confidence depends on transparency about how that tension is managed. I could not retrieve the PDPL text or the implementing regulations to check how they treat government processing for border or security purposes, and readers should not assume either way.
What a proportionate version looks like
None of this requires slowing the rollout. The six-month runway before the mandate is a natural window to publish the missing rules:
- A retention schedule. State how long entry registrations and Visitor ID records are kept after the visitor leaves.
- Purpose limits. Say whether border data may be matched with bank-account data, and under what legal process.
- A visitor-facing privacy notice in English and Arabic, shown inside the app before submission, so non-resident travellers know their rights.
- A redress route. Visitors who are wrongly flagged or blocked from entering should have a way to correct the record from outside the Kingdom.
These are low-cost commitments, and they match what any data-protection law is meant to deliver. Publishing them would make the system more trusted, which is also what makes visitors willing to use it.
The wider lesson
Digital identity works best when it earns trust through narrow, documented use. Saudi Arabia has shown it can build a service that removes real friction at its borders. It has also shown it can extend one credential across sectors, from the border to the bank. The next step is the unglamorous one: written limits that travellers, banks and agencies can all rely on. Without them, a well-designed convenience carries risks that no one outside government can measure.