Saudi PDPL draft amendments: how to prepare
A draft that may change how organisations in Saudi Arabia handle personal data. What it proposes, and four steps to prepare now.
The Saudi Data and AI Authority (SDAIA) has invited the public and stakeholders to share feedback on draft amendments to the Implementing Regulation of the Personal Data Protection Law (PDPL) via the Istitlaa platform. It is a draft and has not yet been adopted.
What the draft proposes
- Reporting personal data breaches within 72 hours.
- More cases requiring impact assessments, including automated decisions and emerging technologies.
- Wider obligations to appoint a data protection officer and to register.
- Storing data inside the Kingdom, with transfers allowed under the Law.
Four steps to prepare now
- Update your record of processing activities and confirm where data is actually stored.
- Test whether you can detect and report a breach within 72 hours.
- Review marketing consents and your privacy notice.
- Map whether you'll need a DPO and impact assessments.
Most importantly: read the draft and share your feedback. Taking part is how good regulation is shaped.
Need to assess your organisation's PDPL readiness? Contact us.
Every need starts with a conversation
Contact us
