Saudi Arabia's Data and Artificial Intelligence Authority (SDAIA) approved a Data Monetization Policy on June 21, 2026 that attempts something genuinely difficult in an era of digital protectionism: threading the needle between public-asset sovereignty and private-sector innovation rather than simply prioritising one at the expense of the other. The result is a framework that is structurally sound, but whose economic impact will be decided entirely by how the implementation machinery is built.
What the Policy Actually Does
The policy establishes government-generated data as a strategic national asset that cannot be sold, transferred, or monetised in raw or unprocessed form. What private entities can do is obtain a usage licence, then process, enrich, analyse, or transform that data into commercial products and services. A national registry will record data providers, permitted uses, and revenue-sharing arrangements. Regulatory sandboxes will allow companies to test monetisation models under supervised conditions before full commercial deployment. Seven core principles underpin the framework: treating data as a national asset, enabling revenue generation, embedding privacy by design, promoting open data, fostering a culture of data sharing, preventing monopolistic practices, and ensuring transparency.
Data classified as Confidential or above is excluded from the policy's scope. Government entities cannot charge other government bodies for data access. And private licensees are prohibited from re-sharing or sub-licensing datasets without explicit approval.
The Case for Sovereign Control
Before critiquing or praising the design, the underlying logic of the raw-data ban deserves a fair hearing. Government data — administrative records, health flows, land registries, transport patterns — is produced at public expense and encodes information about citizens who had no meaningful choice in its collection. Selling it unprocessed to commercial buyers creates straightforward pathways to abuse: data brokers constructing surveillance profiles, foreign entities gaining structural intelligence advantages from a nation's administrative corpus, and pricing dynamics that concentrate access among well-capitalised incumbents while locking out smaller innovators.
Countries that have permitted unchecked commercial access to raw government datasets have frequently found the market allocates access toward concentration, not innovation. SDAIA's ban is not overreach — it reflects a legitimate principle that some resources embedded in an economy should remain public goods rather than becoming privately captured assets.
Why the Value-Add Architecture Is Sound
Having steelmanned the case for control, the policy's core logic — that what is monetisable is the work added, not the data itself — is analytically correct and consistent with how productive data economies have operated elsewhere. A company that resells raw government datasets has created no economic value. A company that processes population movement patterns to build traffic optimisation tools, or enriches agricultural records to develop precision-farming software, has done genuine productive work. Rewarding the latter while blocking the former aligns economic incentives with actual value creation.
Three structural safeguards built into the policy are particularly noteworthy. First, the mandate for fair, non-discriminatory data access prevents government entities from granting exclusive competitive advantages through preferential licensing. Second, explicit anti-monopoly provisions prohibit leveraging data access to entrench market dominance. Third, the national registry's transparency requirements — disclosing original data sources and revenue-distribution arrangements — create accountability that is absent in most comparable frameworks.
The sandbox mechanism deserves particular recognition. Rather than demanding full compliance from day one, it creates a supervised testing environment where firms can develop data products under regulatory observation before commercial launch. This reduces experimentation costs, lowers entry barriers, and gives SDAIA real-time visibility into how the market evolves before rules are locked in permanently.
The Vision 2030 Stakes
This policy is not a standalone measure — it is a regulatory expression of Saudi Arabia's National Strategy for Data and AI (NSDAI), which targets SAR 75 billion in data and AI investments and a pipeline of 20,000 trained specialists by 2030. The Cabinet designated 2026 as the Year of Artificial Intelligence. PwC has projected that AI could contribute $135 billion — equivalent to 12.4 percent of GDP — to the Saudi economy by 2030, the largest such share in the Middle East region.
Government data is the substrate that makes much of that projection realizable. Without structured access to health, transport, environmental, and administrative datasets, large categories of high-value AI applications simply cannot be built. The Data Monetization Policy is an attempt to convert a latent asset — years of accumulated government data — into economic fuel, without surrendering control over the underlying resource. It also dovetails with Saudi Arabia's Personal Data Protection Law (Royal Decree M/19, 2021), which entered full force in September 2023 and embeds penalties of up to SAR 5 million for unauthorised data processing alongside mandatory privacy-by-design obligations.
Where the Risk Concentrates
The framework's greatest vulnerability is not its principles but its implementation specifics. Licensing processes that are slow, opaque, or costly will systematically favour large incumbents. A national registry that is burdensome to navigate will function as a market-entry barrier rather than a transparency tool. Sandbox admission criteria that are not publicly documented will be susceptible to capture by well-connected applicants.
Saudi Arabia's data and AI startup ecosystem is nascent — the NSDAI itself targets nurturing more than 300 data and AI startups by 2030, enterprises that will not arrive at licensing applications with the compliance infrastructure of established enterprises. If licence turnaround times are measured in months rather than days, if registry participation carries significant fees, or if sandbox access is effectively limited to established firms, the anti-monopoly provisions of the policy could be quietly neutralised by the cost structure of compliance.
SDIA should publish binding service-level timelines for licence approvals, clearly document sandbox admission criteria, and create a lightweight registration tier explicitly designed for startups. These are not afterthoughts — they are the mechanisms by which the policy's stated objectives become real outcomes.
The Broader Signal
At a moment when many governments default to either total data nationalism or uncritical commercialisation, SDAIA's value-add model offers a more defensible middle path. The raw-data ban is principled. The sandbox is well-designed. The anti-monopoly safeguards are genuine. Whether those principles translate into a thriving data economy — or merely a well-intentioned framework that concentrates benefits among incumbents — will be determined not by the policy text but by the turnaround time on the first thousand licence applications.