Saudi Arabia: compliance overview
3 regulations, 12 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2026-09-12
Verified: the amended PDPL, its Implementing Regulation, the transfer regulation and the supporting rules are all published by SDAIA as the operative texts
Saudi Personal Data Protection Law (PDPL) and its Implementing Regulation2026-09-12
Verified: the current English text on SDAIA’s site is Version 0.2 (August 2024); Article 9 provides that it enters into force on publication in the Official Gazette
Saudi Regulation on Personal Data Transfer Outside the Kingdom2026-09-12
Verified: SDAIA’s Laws & Regulations page currently publishes the AI Ethics Principles (2025) and the Generative AI Guidelines (government and public editions, 2025)
SDAIA AI Ethics Principles and Generative AI Guidelines
Applicable regulations (3)
Saudi Personal Data Protection Law (PDPL) and its Implementing Regulation
Typical triggers for a Chinese AI company: (1) establishing a company, joint venture or data centre in Saudi Arabia and processing employee or customer data; (2) having no Saudi entity but offering apps, model APIs, cloud services, smart hardware or robots to Saudi residents and collecting accounts, location, voice, imagery, health or vehicle data — Article 2(1) reaches parties outside the Kingdom directly; (3) acting as processor for a Saudi customer (especially government programmes, banks and healthcare providers) for labelling, training, inference or operations; (4) selling camera- or microphone-equipped hardware through a Saudi distributor that streams data back to China; (5) having personal data processing as the main activity — for example a platform that trains models on user data — which is one of the mandatory registration cases under Article 2 of the National Register of Controllers Rules. Note that those Rules state separate registration rules for controllers located outside the Kingdom will be issued later, so offshore companies should keep tracking this.
6 obligations · reviewed 2026-09-12
Saudi Regulation on Personal Data Transfer Outside the Kingdom
Any movement of personal data originating in Saudi Arabia out of the Kingdom is in scope. The four most common patterns for a Chinese AI company: (1) sending Saudi users’ prompts, voice, imagery or behavioural logs back to China or a third country for model training and evaluation; (2) a China-based team remotely operating a Saudi customer’s system and thereby accessing personal data — remote access is treated in practice as a transfer; (3) group HR, finance or support systems centralised in China or Singapore that process Saudi employee and customer data, which is precisely the Article 4(2)(c) “necessary central operations within a group of multinational entities” case requiring binding common rules or standard contractual clauses; (4) research collaborations with Saudi institutions or hospitals that move insufficiently de-identified health, genomic or imaging data offshore, which is continuous or widespread transfer of sensitive data under Article 7(1)(b) and requires a prior risk assessment.
3 obligations · reviewed 2026-09-12
SDAIA AI Ethics Principles and Generative AI Guidelines
These documents are not directly fineable legislation, but they bite commercially in three ways for a Chinese AI company: (1) Saudi government and state-owned enterprise procurement — data and AI governance clauses routinely reference SDAIA’s ethics principles and conformity assessment expectations, so bids and technical proposals must map to them clause by clause; (2) joint ventures with, or deployment by, Saudi partners, who write these principles into contractual compliance undertakings and acceptance criteria; (3) where the AI system processes personal data, the privacy and security controls in the principles overlap heavily with the statutory duties in the PDPL and its Implementing Regulation, so a breach often is a PDPL breach and attracts Article 36 penalties. The “unacceptable risk” tier’s position on social profiling also means products built on non-credit social behaviour scoring have no compliant path into the Saudi market.
3 obligations · reviewed 2026-09-12
Data transfer routes
Saudi PDPL transfer and disclosure outside the Kingdom (Art. 29)
No volume threshold. Article 29 is structured differently from the EU model: it first sets a purpose gate (the four grounds in Art. 29(1)) and then layers on three conditions (Art. 29(2)(A), (B) and (C)), all of which must be met. The operative point is Art. 29(2)(B): the adequate level of protection is determined by an assessment conducted by the Competent Authority (SDAIA) in coordination with whomever it deems appropriate from the other relevant authorities, so the adequacy call sits with the regulator, not the company. Article 29(2)(C) then requires per-transfer minimisation that must be demonstrable. An important limit on this pass: Art. 29(4) delegates the provisions, criteria and procedures - including the exceptions for Controllers from the Art. 29(2)(B) and (C) conditions and the controls and procedures for those exemptions - entirely to the Regulations, and the text of those Regulations (including the dedicated data transfer regulation) could not be retrieved from an official Saudi source in this pass. The current exemption list, the list of countries assessed as providing an adequate level, and whether a risk assessment or registration must be filed with SDAIA are therefore unverified. Confidence is medium and the SDAIA-published Regulations and transfer rules must be checked before relying on this entry.
Lead time: Estimate: 2-6 weeks for the purpose and condition analysis, the minimisation rationale and the contract terms. Where an exemption procedure under the Regulations is needed, its timeline was not verified in this pass and should be assessed per project. · Cost band Medium
What you can use right now
Sources (9)
- Saudi Personal Data Protection Law — official English textSaudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- Implementing Regulation of the Saudi Personal Data Protection Law — official English textSaudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- SDAIA — Rules for Appointing a Personal Data Protection Officer (Version 01, August 2024)Saudi Data & AI Authority (SDAIA) · Art. 5 · retrieved 2026-09-12
- SDAIA — Rules Governing the National Register of Controllers Within the KingdomSaudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- SDAIA — Laws & Regulations hub (PDPL, Implementing Regulation, transfer regulation, DPO rules, AI ethics principles)Saudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- Saudi Regulation on Personal Data Transfer Outside the Kingdom — official English text (Version 0.2, August 2024)Saudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- SDAIA — Risk Assessment Guideline for Transferring Personal Data Outside the KingdomSaudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- SDAIA — AI Ethics Principles (2025)Saudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
- SDAIA — Generative Artificial Intelligence Guidelines for the Public (2025)Saudi Data & AI Authority (SDAIA) · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.