On this page
Delivered with a verified NCA-registered partner
Summit runs PDPL readiness and VAPT for Saudi organisations end to end, with our verified NCA-registered partner firm, and has served 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
If your company stores Saudi personal data on overseas cloud regions, or relies on a group data centre outside the Kingdom, read the published draft this month.
What the official announcement confirms
The Saudi Press Agency release of 6 October 2026 says the draft is intended to:
- clarify the procedures and controls in the Implementing Regulation;
- enable entities and individuals subject to the law to comply;
- support the law’s goal of protecting personal data;
- clarify the provisions related to storing personal data; and
- strengthen trust in services that rely on personal data.
Local coverage (Sabq, 8 October 2026) confirms the consultation runs until 5 November 2026. It sits among 40 projects that the Istitlaa platform put out for comment that week.
That is what is officially on record. Anything more specific has to come from the draft text on Istitlaa, so download it and read the article-by-article changes yourself.
The four areas to read closely
From the announcement and from the direction of SDAIA’s previous round of amendments (April to May 2025), these are the areas where businesses have the most at stake.
1. Data storage and localisation
“Storage” is the one topic SDAIA named explicitly. History is useful here: an early 2022 draft of the Regulation included a rule that controllers store and process personal data inside the Kingdom, and that rule did not survive into the final 2023 text. Check whether the new draft:
- sets a default for storage inside the Kingdom;
- ties storage location to data categories, such as sensitive data;
- links storage to the existing rules on transfers outside the Kingdom.
2. Breach notification
Today, the Regulation (Article 24) requires notifying SDAIA within 72 hours of becoming aware of a breach. The 2025 draft proposed removing the standalone “personal data breach” definition and leaning on the PDPL itself and SDAIA’s breach procedural guide. Check whether the 72-hour window, the trigger threshold or the content of notifications changes.
3. The Data Protection Officer
The 2025 draft proposed folding the standalone DPO appointment rules into the Regulation. It also proposed requiring controllers to document the appointment and notify SDAIA through its platform as soon as a DPO is appointed or replaced. Check whether the new draft keeps that approach or changes who must appoint one.
4. The National Register of Controllers
The 2025 draft proposed writing mandatory registration criteria directly into the Regulation, covering, for example, public entities, controllers whose main activity is processing personal data, controllers that process sensitive data, and certain controllers that transfer data abroad. Check the 2026 criteria against your own profile.
Status check
We have not seen a published final version of the 2025 round. Treat both rounds as proposals until SDAIA publishes approved text.
How to respond to the consultation
Comments on Istitlaa are read, and specific ones carry more weight. Good submissions:
- quote the exact article number and proposed wording;
- explain the operational impact with a real example (“our payment provider’s tokenisation runs in region X”);
- propose alternative wording or a transition period;
- arrive before 5 November 2026.
What to do now, whatever the final text says
- Map storage locations. List every system holding Saudi personal data and where it physically sits, including backups and SaaS tools.
- Review transfer mechanisms. Confirm the basis for any processing outside the Kingdom under the existing transfer regulation.
- Pressure-test your 72-hour process. Run a tabletop exercise.
- Decide on the DPO question. Document who it is, or why you do not need one.
- Check registration. Confirm whether you are registered on SDAIA’s platform, and whether you should be.
Storage changes often mean migrations, and migrations mean new attack surface. Plan a penetration test of any new hosting environment before personal data moves into it.
How Summit helps
Summit can run a quick impact assessment against the draft, help you prepare consultation comments, and build the remediation plan once the final text lands. Our Saudi PDPL guide sets out the approach. If storage moves, our VAPT, delivered with our verified NCA-registered partner, validates the new environment. We have supported 115+ Saudi clients across Riyadh, Jeddah, Dammam and other cities, end to end.
Do not wait for the final text
Book a 45-minute draft-impact session with Summit before 5 November. Contact our team.
Related reading: PDPL enforcement: SDAIA’s 48 decisions · VAPT provider checklist
Frequently asked questions
When does the SDAIA consultation on PDPL Implementing Regulation amendments close?
On 5 November 2026. It opened on the Istitlaa public consultation platform on 6 October 2026.
Are the October 2026 amendments in force?
No. They are draft amendments under public consultation. They take effect only once approved and published.
Do the draft amendments require data localisation in Saudi Arabia?
SDAIA says the draft clarifies provisions related to storing personal data. Read the published draft text on Istitlaa to see exactly what is proposed, and do not rely on secondhand summaries.
Will the 72-hour breach notification rule change?
The current rule is notification to SDAIA within 72 hours of becoming aware of a breach. Check the draft for any change, and keep complying with the current rule until a new text is in force.
How can my company submit comments?
Through the Istitlaa public consultation platform, before the closing date, with comments referenced to specific articles.
