Saudi Arabia Consults on Data Protection Implementing Regulation Reforms

The Saudi Data and Artificial Intelligence Authority (SDAIA) launched a public consultation on 6 October 2026 regarding proposed amendments to the Implementing Regulation of the Personal Data Protection Law (PDPL), according to legal analysis from Pinsent Masons. Saudi Arabia last updated its PDPL framework in 2023.

Under the proposed amendments, the 30-day statutory response period for data subject access requests is retained, but unfulfilled requests may be deemed rejected by the controller, entitling individuals to file a complaint with SDAIA. The draft also proposes amending Article 37 to remove the current 90-day time limit for submitting data subject complaints to the authority.

On personal data breaches, proposed amendments to Article 24 maintain the 72-hour reporting requirement to SDAIA but appear to remove the current notification threshold, which Pinsent Masons noted could broaden reportable incidents. Meanwhile, revised Article 33 removes regulator templates for records of processing activities, while requiring controllers to retain data processing records for an additional five years from the completion date.

For promotional and awareness activities, Article 28 requires controllers with existing relationships to verify and retain evidence of consent before processing personal data and provide a straightforward opt-out process. The public consultation is open until 5 November 2026, and Article 38 stipulates that the regulations will take effect 60 days following publication in the Official Gazette.