A New Line Between Public Data and Private Profit
On June 20, 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) issued its national Data Monetization Policy, the Kingdom's first comprehensive rulebook for turning government-held data into commercial products. The policy rests on seven principles — treating data as a national asset, privacy by design, promoting open data, fostering a culture of data sharing, preventing monopolistic practices, transparency, and revenue generation — and applies to any government data used to build data products or services, including data accessed by private contractors performing government work. Data classified "Confidential" or above is carved out entirely (Let's Data Science; MIT Sloan Management Review Middle East).
The headline restriction is simple: raw government data cannot be sold, transferred, or monetized directly. Value has to come from processing, analysis, enrichment, or some other transformation — a licensed firm can sell a traffic-pattern analytics product built from transport-ministry data, but cannot resell the underlying dataset itself. To make that market function, SDAIA is standing up registration systems, data-use licenses, regulatory sandboxes, and dedicated platforms, and requires that government data be made available to private firms on a "fair and non-discriminatory basis" so incumbents can't lock in exclusive access (MIT Sloan Management Review Middle East).
Why the Design Holds Up
The raw-data ban is the policy's smartest feature. It forecloses the crudest failure mode — a ministry simply auctioning a citizen database to the highest bidder — while still letting the state capture value from a digital economy that Saudi Arabia's Ministry of Communications and Information Technology puts at roughly SAR 495 billion, or about 15% of national GDP (MCIT). Requiring transformation before monetization, licensing intermediaries rather than free-for-all access, and running sandboxes before full rollout are all recognizable tools from more mature open-data regimes in the EU and UK. Layered onto a market where Saudi big-data analytics revenue is projected to nearly quadruple from $3.58 billion in 2024 to $12.24 billion by 2030 (ResearchAndMarkets), a predictable licensing framework is a genuine improvement over ad hoc data deals negotiated ministry by ministry — the kind of opacity that scares off the private capital SDAIA is trying to attract.
The Steelman: One Authority, Three Hats
Civil-society critics have a fair point worth stating plainly before dismissing it. SDAIA is not a neutral market referee entering this space for the first time — it is simultaneously Saudi Arabia's data protection enforcer, its AI policy-setter, and now a commercial beneficiary of data monetization. It has already used its enforcement powers aggressively: by SDAIA's own account, it issued 48 decisions in the past year against organizations found in violation of the Personal Data Protection Law, with fines reaching SAR 5 million per breach and doubling for repeat offenses (Global Privacy & Security Compliance Blog). A regulator that enforces privacy rules with one hand and profits from data commercialization with the other has an incentive structure that a genuinely independent data protection authority does not.
That concern doesn't exist in a vacuum. Saudi Arabia's broader digital environment has drawn documented criticism this year: Meta geo-blocked the Facebook and Instagram accounts of ALQST for Human Rights, Democratic Diwan, and individual researchers and activists inside Saudi Arabia starting April 30, 2026, at the government's request, part of a pattern affecting over 100 accounts since March (ALQST for Human Rights). Separately, a Meta Oversight Board study of 13,524 prompts across ten commercial AI models found they refused requests to criticize Saudi Arabia's leadership 31% of the time, versus roughly 8-9% for equivalent requests about the US and UK — evidence that authoritarian speech norms are shaping AI outputs globally, not just domestically (MediaNama). In that context, skepticism about a state agency consolidating control over the data pipelines feeding AI products is not paranoia — it's pattern-matching.
Our View
The policy's mechanics are sound and worth studying by other governments building data-economy frameworks: ban raw-data sale, require licensed transformation, mandate non-discriminatory access, and sandbox new entrants before full authorization. That's proportionate regulation, not overreach, and it should accelerate legitimate private-sector investment in a fast-growing market. But mechanics are not governance. SDAIA's conflict of interest — regulator, enforcer, and monetizer in one building — is a structural gap the policy text doesn't address, and it matters more in a jurisdiction with Saudi Arabia's documented record on digital speech restrictions than it would elsewhere. Vision 2030's data ambitions don't require SDAIA to give up any of its three roles. They do require an independent audit function, public reporting on licensing decisions, and a credible appeals path for firms and citizens alike — none of which the policy currently promises. Saudi Arabia has built a good rulebook for a data market. Whether it builds the referee to match will determine if this becomes a genuine growth engine or another lever of centralized control dressed in market language.