Saudi Arabia Reopens the PDPL: Localisation, 72-Hour Breach Reporting and AI-Relevant Impact Assessments

Week of 19 October 2026 | Compiled by Team Paringa

SDAIA's draft amendments to the PDPL Implementing Regulation are the biggest Saudi data protection development in months, and they land directly on AI governance programmes. This brief covers what is proposed, what it means for AI use cases, and what to do before the consultation closes.

What Happened This Week

🔴 SDAIA consults on extensive PDPL amendments: localisation, 72-hour breach reporting, wider registration

The Saudi Data and Artificial Intelligence Authority (SDAIA) opened public consultation on draft amendments to the PDPL Implementing Regulation on 6 October 2026. Consultation runs to 5 November 2026 via the Istitlaa platform, and if approved the changes take effect 60 days after publication in the Official Gazette. Clyde & Co and Reed Smith both published analyses of the draft this month.

Three changes carry the most operational weight. Draft Article 23 would require controllers to store personal data inside Saudi Arabia, while still allowing transfers and disclosures abroad under the PDPL. Reed Smith notes the wording is unclear and could be read as requiring a local copy even for lawful transfers. Draft Article 24 removes the harm threshold for notifying SDAIA, so breaches, damage or unauthorised access would be reportable within 72 hours of awareness. Draft Article 34 makes registration with the National Register of Controllers mandatory for public entities, controllers whose core activities involve personal data, those handling sensitive data or data of people lacking legal capacity, and those transferring data abroad.

Smaller changes add up. Responses to SDAIA requests would be due within 20 business days (new Article 36), the 90-day complaint filing limit is removed, privacy policies must be in clear, simplified language suited to the audience (which Clyde & Co suggests will often mean Arabic), and Reed Smith reads the draft as removing the prior-interaction exception for marketing consent. Note that the two firms describe the marketing change slightly differently, so check the draft text on Istitlaa.

Sources: Clyde & Co | Reed Smith

Two weeks is not long, so decide now whether to respond. Localisation wording is the clearest candidate for clarification, because it determines whether cloud and AI architectures that rely on offshore processing need redesign. Even before the text is final, test your incident process against a 72-hour clock and a no-harm-threshold trigger, and check whether your organisation would fall into the new registration categories. Organisations with Saudi data in global AI platforms should map that data now.

🔴 New impact assessment triggers pull AI use cases into scope

Although the draft contains no dedicated AI provisions, Clyde & Co and Reed Smith both highlight the widened data protection impact assessment (DPIA) triggers in draft Article 25. New triggers include processing data of minors or people with limited legal capacity, large-scale or systematic monitoring, "emerging technologies" (not defined in the draft) and solely automated decisions affecting rights or interests. Most enterprise AI deployments touching personal data, from credit scoring to HR screening to customer analytics, could meet at least one of these tests.

Data protection officer (DPO) rules are also being reworked. Under the draft, appointment would be required for public entities providing services involving personal data, for controllers whose primary activities involve regular, systematic, large-scale monitoring, and for those whose core activities involve sensitive data. Contact details must be submitted to SDAIA via its platform. Separately, Reed Smith reads draft Article 23(1) as limiting NCA standards to Critical National Infrastructure providers, with others following "recognised cybersecurity standards", which makes the choice of framework (such as ISO/IEC 27001) a documented decision.

Data subject rights tighten as well. The 30-day response period stays, with extensions of up to 30 days per Reed Smith, but unfulfilled requests are deemed rejected and "manifestly unfounded" is no longer a refusal ground, per Reed Smith. Individuals can complain to SDAIA.

Sources: Clyde & Co | Reed Smith

This is where PDPL and AI governance meet. If your AI inventory does not yet record which models make solely automated decisions or use personal data, you cannot answer a DPIA trigger question. Build the register first, then template a DPIA that doubles as an AI risk assessment, so one piece of work serves both PDPL and ISO/IEC 42001 evidence. Raise "emerging technologies" with your legal advisers as a definitional gap worth flagging in the consultation.

🟡 No dedicated AI rules, but a drafting gap worth watching

Clyde & Co is explicit that the draft has no dedicated AI provisions. The closest references are the DPIA triggers for emerging technologies and automated decisions. That matches the wider picture of Saudi AI governance working through strategies, ethics principles and existing data law rather than a standalone AI statute.

For buyers, this means AI obligations will continue to arrive through data protection, sector regulators and procurement requirements. The ambiguity is real: "emerging technologies" is undefined, and the localisation clause could be read narrowly or broadly. Clyde & Co's summary also advises checking the draft on Istitlaa before relying on any secondary analysis, and we echo that.

Sources: Clyde & Co

Do not wait for an AI-specific Saudi law before acting. The PDPL is already the enforcement hook for AI that handles personal data, and this draft sharpens it. Teams that align to ISO/IEC 42001 now will be better placed whichever way the final text lands. Treat ambiguity as a reason to document your interpretation, not to delay.

What UAE and KSA Compliance Leaders Are Dealing With

Saudi compliance leaders face a short consultation window and a draft that touches storage, incident response, registration and AI-adjacent assessments all at once. The practical pressure is on cloud architecture, incident playbooks and DPO resourcing, with an Arabic-language privacy notice requirement possible on top.

In the UAE, the CBUAE enforcement regime covered in last week's edition remains the main supervisory pressure for financial institutions. We did not find a new, verifiable UAE regulatory announcement dated this week, so we are not reporting one.

Three Things Worth Watching Next Week

1. Consultation responses and law firm commentary — With 5 November approaching, expect industry bodies and cloud providers to comment on localisation wording.

2. Clarification on "emerging technologies" — Watch whether SDAIA or commentators propose a definition that explicitly captures AI systems.

3. First CBUAE enforcement decisions — Still untested, and still the most important signal for UAE financial AI governance.

Could not verify: any new UAE PDPL or CBUAE development dated 12-19 October 2026; any ISO/IEC 42001 news this week

Questions? hello@paringa.ai

Paringa helps UAE and KSA organisations turn AI governance requirements into evidenced, audit-ready practice. We pair regulatory insight with hands-on delivery so your next supervisory conversation is a confident one. | 19 October 2026 | © Paringa Ltd