On this page
- What is the SDAIA National Register of Controllers?
- Who must register on the National Register of Controllers today?
- Do companies outside Saudi Arabia need to register with SDAIA?
- How do you register on SDAIA’s National Data Governance Platform?
- What information should you prepare before you start?
- What happens after you register with SDAIA?
- How would the October 2026 draft amendments change registration?
- How Sumrite helps
- Frequently asked questions
Registration is one of the first things an SDAIA investigator will check, and it is one of the easiest PDPL duties to get right. This guide covers who is in scope, the exact platform steps, what to have ready, and how the draft amendments currently under review would change the picture. For the wider framework, start with our Saudi PDPL compliance guide.
What is the SDAIA National Register of Controllers?
The National Register of Controllers is SDAIA’s official, publicly verifiable list of organisations and individuals that control personal data in Saudi Arabia. It is governed by SDAIA’s Rules Governing the National Register of Controllers Within the Kingdom, published in 2024 under the PDPL and its Implementing Regulation.
The register sits on the National Data Governance Platform, which is also where controllers file breach notifications, run privacy impact assessments and complete SDAIA’s compliance self-assessment. Sector regulators have been pushing their licensees onto it: the Saudi Press Agency reported the Transport General Authority urging land, rail and maritime operators to register in September 2025, and the Ministry of Tourism calling on hospitality and travel providers to do the same in December 2025. Both notices describe the register as a unified national system for monitoring PDPL compliance.
Who must register on the National Register of Controllers today?
Under the current Rules, a PDPL controller must register if it meets any one of four criteria. The test is about the nature of the controller and what it processes, not about company size.
| Criterion (current Rules, in force) | Typical examples |
|---|---|
| The controller is a public entity | Ministries, authorities, public hospitals and universities |
| The controller’s main activity is based on processing personal data | Marketing and data analytics firms, recruitment platforms, payroll bureaux, CRM-heavy consumer apps |
| The controller processes sensitive data | Clinics, pharmacies, insurers, HR teams holding health records, anyone using biometrics for identification |
| An individual processes personal data for purposes beyond personal or family use | Sole practitioners and freelancers handling client data |
The sensitive-data criterion is the one most companies underestimate. SDAIA’s Guide to the Saudi Personal Data Protection Law lists seven categories of sensitive data, including health, genetic and biometric data and data revealing criminal convictions. An ordinary employer holding sick notes or fingerprint attendance records may already process sensitive data. Bird & Bird made the same point when the Rules were issued: the threshold appears low because so many organisations touch sensitive data in some form.
Processors do not register as controllers
The register is for controllers, the organisations that decide why and how personal data is processed. A pure processor, such as a hosting provider acting only on a client’s instructions, is not a controller for that processing. Many vendors are both: a processor for client data and a controller for their own staff and customer data.
Do companies outside Saudi Arabia need to register with SDAIA?
Companies outside Saudi Arabia can be in scope, because the PDPL applies to processing of personal data of people in the Kingdom by parties outside it. If a foreign controller meets one of the four criteria for Saudi personal data, it should treat registration as applicable.
As of November 2026, the National Data Governance Platform’s registration menu lists four routes: government entities, private organisations, non-profit entities and entities outside the Kingdom. When the Rules were first issued, Bird & Bird reported that SDAIA would issue separate registration rules for foreign controllers in due course. The October 2026 draft amendments would go further, as covered below. A foreign SaaS provider selling into Saudi Arabia should read this alongside our guide to PDPL cross-border data transfers.
How do you register on SDAIA’s National Data Governance Platform?
Registration is an online process run by a named representative of the controller, ending with an SDAIA-issued registration certificate. Based on the Rules as summarised by Al Tamimi & Company and Morgan Lewis, the sequence is:
- Confirm you are in scope. Test your organisation against the four criteria and record the result, including a “not required” decision.
- Appoint a representative. Public entities appoint one using the form provided by SDAIA. For private entities, an authorised person makes the appointment, which Morgan Lewis reports runs through the authorisation system on the Saudi Business Center platform. Individual controllers act as their own representative.
- Choose the correct route. Pick government, private, non-profit or outside-the-Kingdom registration on dgp.sdaia.gov.sa.
- Assess the DPO requirement. The representative assesses whether a Data Protection Officer must be appointed under Article 32 of the Implementing Regulation.
- Complete the entity profile. Enter the mandatory fields, including the entity’s logo, official email, contact number and headquarters, plus the representative’s own official email and number.
- Add DPO details if applicable. The DPO can be an employee, an external contractor or a contractor located outside the Kingdom.
- Submit and receive the certificate. SDAIA reviews the application and issues a registration certificate on approval.
Morgan Lewis reported in December 2024 that no registration fee applied. Check the platform at the time you register rather than relying on that.
What information should you prepare before you start?
Prepare the entity profile, the representative’s authority and contact details, the DPO decision and your records of processing before you log in. Most delays come from missing authority documents, not from the form itself.
- Entity profile
- Legal name, logo, headquarters address, official email and phone number.
- Representative
- Proof of authority to act for the entity, official email and phone number.
- DPO (employee or contractor)
- National ID or residency number, date of birth for verification, and official contact details.
- DPO outside the Kingdom
- Full name, official email and contact number.
- Records of processing
- Your records of processing activities, which Bird & Bird notes you can draw on for the platform's compliance assessment.
- Scope decision
- A short, dated note of which registration criterion applies and why.
If you do not yet have records of processing, build them first. Our guide to personal data discovery for the PDPL shows how to find the data and turn it into a record SDAIA will accept.
What happens after you register with SDAIA?
After registration, the controller holds a certificate valid for up to five years and takes on ongoing duties on the platform. According to Al Tamimi’s summary of the Rules:
- The certificate carries a serial number, the entity’s details and issue and end dates, and the public can verify it.
- SDAIA notifies you at least 30 days before expiry, with a five-day grace period for continued platform access.
- The representative must keep profile and DPO details up to date.
- Personal data breaches are notified to SDAIA through the platform within 72 hours of becoming aware of them, under Article 24 of the Implementing Regulation.
- The platform’s compliance assessment involves periodic evaluations, alongside privacy impact assessment tools and, for public entities, legal support.
Registration also makes you easier to find. Once you are on the register, expect SDAIA’s compliance assessment to ask how you protect the data, which is where documented security testing earns its place. Our post on SDAIA enforcement decisions and PDPL penalties explains why “failure to implement safeguards” is one of the categories already penalised.
How would the October 2026 draft amendments change registration?
SDAIA’s October 2026 draft would move the registration criteria into the Implementing Regulation and add new triggers, most significantly any controller that transfers or discloses personal data outside the Kingdom. These are proposals only. SDAIA published the draft on the Istitlaa platform, and the Saudi Press Agency listed it among projects open for comment until 5 November 2026.
| Trigger | Current Rules (in force) | October 2026 draft (proposal) |
|---|---|---|
| Public entities | Yes | Yes |
| Main or core activity is processing personal data | Yes | Yes |
| Processing sensitive data | Yes | Yes |
| Processing data of people lacking legal capacity | Not a separate trigger | Added |
| Transferring or disclosing data outside the Kingdom | Not a trigger | Added |
| Individuals processing beyond personal or family use | Yes | Not listed in law-firm summaries of the draft |
Reed Smith reads the transfer trigger, in draft Article 34, as applying equally to controllers based outside Saudi Arabia, which would bring most multinational groups and anyone using offshore cloud regions into scope. As drafted, the amendments would take effect 60 days after publication in the Official Gazette. Our breakdown of the draft PDPL Implementing Regulation amendments covers the in-Kingdom storage and breach notification proposals in the same text.
Do not wait for the final text
If you send Saudi personal data abroad today and are not registered, prepare the registration file now: scope note, representative authority, DPO decision and records of processing. If the transfer trigger is adopted, you will have about 60 days from publication to act.
How Sumrite helps
Sumrite helps controllers work out whether they must register, prepare the representative, DPO and records-of-processing evidence, and close the security gaps a compliance assessment will surface. Our Saudi PDPL compliance service covers gap assessment and readiness, and our cloud security assessment and web application VAPT produce the technical-safeguard evidence SDAIA looks for. Sumrite runs PDPL readiness and VAPT end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. See our Saudi Arabia page or work through the PDPL compliance checklist.
Not sure whether you must register?
Bring your processing activities and transfer map to a 30-minute call and leave with a clear registration decision. Book a scoping call.
Frequently asked questions
Who must register on the SDAIA National Register of Controllers?
Under SDAIA's Rules Governing the National Register of Controllers Within the Kingdom, registration is required for public entities, controllers whose main activity is based on processing personal data, controllers that process sensitive data, and individuals processing personal data beyond personal or family use. Controllers outside these criteria are not currently required to register, but should document why.
Where do controllers register with SDAIA?
Controllers register on SDAIA's National Data Governance Platform at dgp.sdaia.gov.sa. The platform has separate registration routes for government entities, private organisations, non-profit entities and entities outside the Kingdom, and it also hosts compliance assessment, privacy impact assessment and breach notification services.
How long is an SDAIA registration certificate valid?
An SDAIA registration certificate on the National Register of Controllers is valid for up to five years. SDAIA notifies the controller at least 30 days before expiry so that it can apply for renewal, and the public can verify a controller's registration.
Do foreign companies have to register with SDAIA?
The Personal Data Protection Law (PDPL) applies to processing of personal data of people in Saudi Arabia even by parties outside the Kingdom, and the National Data Governance Platform lists a registration route for entities outside the Kingdom. SDAIA's October 2026 draft amendments would also make registration mandatory for any controller that transfers or discloses personal data outside the Kingdom.
Have the October 2026 registration changes taken effect?
No. As of November 2026 the wider registration criteria are draft amendments to the PDPL Implementing Regulation that SDAIA put out for public consultation until 5 November 2026. As drafted, they would take effect 60 days after publication in the Official Gazette, once approved.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
