Managed IT and cyber security for regulated firms in Riyadh and KAFD
Managed IT and cyber security for regulated firms in Riyadh and KAFD
On 6 October 2026 the Saudi Data and Artificial Intelligence Authority (SDAIA) published draft amendments to the PDPL Implementing Regulation for public consultation, which closed on 5 November 2026. The proposals include a requirement to store personal data inside the Kingdom (with transfers still allowed under the law), a lower threshold for reporting personal data breaches, wider triggers for data protection impact assessments, rules on Data Protection Officers and controller registration moved into the regulation, and a 20-business-day deadline to answer SDAIA’s requests. These are proposals, not law, but most of the IT work they imply is worth doing anyway.
SDAIA published draft amendments to the Implementing Regulation of the Personal Data Protection Law on 6 October 2026, and invited comments until 5 November 2026. At the time of writing they have not been finalised, so the current regulation still applies.
The PDPL itself has been fully enforceable since 14 September 2024. If you want the current rules, start with our Saudi PDPL IT checklist.
| Area | What is proposed | What it means for IT |
|---|---|---|
| Data localisation | Draft Article 23(2): controllers store personal data inside the Kingdom; transfers abroad still possible under the law and regulations | Know where every system stores personal data, including backups and support tools, and plan in-Kingdom options |
| Breach notification | Notification to SDAIA triggered by damage to personal data, without the “potential harm” test; notification contents adjusted | Better detection and triage, and a documented decision for every incident |
| Security measures | Article 23(1): measures to prevent leakage, damage or unauthorised access; NCA standards for those in NCA scope, recognised standards and best practice for others | A recognised baseline, such as the NCA Non-CNI controls or ISO 27001, applied and evidenced |
| Impact assessments | DPIA triggers widened: minors, large-scale processing or systematic monitoring, emerging technologies, solely automated decisions | IT input on new systems, especially AI and monitoring tools, before go-live |
| DPOs | DPO rules moved into the regulation; appointments documented and DPO details kept current on SDAIA’s platform | A named DPO with access to IT reports, incidents and access reviews |
| Registration | Controller registration rules moved into the regulation, including controllers that transfer data outside the Kingdom | A list of transfers and the systems behind them |
| Data subject requests | 30 days, extendable by up to 30 more, with narrower grounds for extension | Being able to find and export one person’s data quickly |
| SDAIA requests | Respond within 20 business days | Evidence that can be produced quickly, not rebuilt each time |
The headline proposal is that controllers would store personal data within Saudi Arabia, while still being able to transfer or disclose it abroad in line with the law. How strictly that will be applied is one of the biggest open questions in the consultation.
Whatever the final wording, the first step is the same: know where your personal data actually lives. That includes Microsoft 365, CRM and HR systems, file sharing, backups, logs and the tools your IT provider uses. Microsoft has announced a Saudi Arabia East cloud region, and more providers now offer in-Kingdom hosting. Our guide to Saudi data residency covers the options.
Today, a controller must notify SDAIA within 72 hours of becoming aware of a personal data breach, through the National Data Governance Platform, and tell affected individuals without undue delay. The draft appears to lower the threshold for which breaches must be notified, by removing the requirement for potential harm to individuals and tying notification to damage to personal data.
If that goes through, more incidents will need a formal decision and possibly a report. That makes 24/7 monitoring, good logs and a tested incident process more important, not less. See our guide to cyber incident reporting in Saudi Arabia.
The draft would require organisations within the NCA’s scope to follow NCA standards, and everyone else to follow recognised cybersecurity standards and best practice. For many private companies, the NCA’s new Non-CNI controls are the obvious recognised baseline to use. See our guide to the NCA Non-CNI cybersecurity controls.
Cre8 IT is registered with the National Cybersecurity Authority (NCA) as a cybersecurity service provider through the Haseen platform. We’re ISO 27001:2022 certified, and we help Saudi organisations with the IT side of data protection: data mapping, in-Kingdom hosting options, Microsoft 365 security, 24/7 monitoring and incident response. We work alongside your DPO and legal advisers, and we’ll update this guide when SDAIA publishes the final text.
Want to know how ready you are? Book a free review.
Last reviewed 10 November 2026. This guide explains the IT side of the rules and is not legal advice. Check the current position with the regulator or your legal adviser.
Not yet. SDAIA published draft amendments on 6 October 2026 and the public consultation closed on 5 November 2026. Until the final text is issued, the current Implementing Regulation applies.
The draft proposes that controllers store personal data inside the Kingdom, while still allowing transfers under the law and regulations. How strictly that applies will depend on the final text.
Under the current rules, within 72 hours of becoming aware of the breach, through the National Data Governance Platform. The draft amendments would lower the threshold for which breaches must be reported.
It is sensible to map where personal data is stored, list your transfers abroad, adopt a recognised security baseline and test your incident process. Those steps help under the current rules and the proposed ones.