Alfi Legal | Data Protection & Privacy | November 2026

The Saudi Data & AI Authority (SDAIA) has opened its National Register of Controllers to organisations established outside the Kingdom. This closes a practical gap that has existed since the Personal Data Protection Law (PDPL) became fully enforceable in September 2024: foreign companies were subject to the law but, without a Saudi commercial registration, had no route to register.

Why this matters

The PDPL reaches beyond Saudi borders. It applies not only to processing carried out in the Kingdom, but also to processing by entities abroad of personal data relating to individuals residing in Saudi Arabia. A foreign e-commerce platform, a regional head office running Saudi payroll, or an overseas software provider holding Saudi customer data may therefore fall squarely within its scope.

Until now, registration on SDAIA’s National Data Governance Platform was effectively limited to entities holding a Saudi commercial registration. Overseas controllers that were required to register were left in an uncertain position. The new service removes that obstacle.

Who is required to register

Under SDAIA’s Rules Governing the National Register of Controllers, registration is mandatory for:

• public entities;
• entities whose principal activity consists of processing personal data;
• entities that process sensitive personal data, such as health, genetic, credit or biometric data; and
• individuals who process personal data for purposes other than personal or family use.

Foreign organisations meeting any of these criteria while processing data of Saudi residents should now treat registration as an active obligation rather than a theoretical one.

Registration is the gateway to compliance

Registration is not a formality. Key regulatory channels on the platform are, in practice, open only to registered controllers, including:

• notifying SDAIA of the appointment of a Data Protection Officer (DPO); and
• reporting personal data breaches, which must reach SDAIA within 72 hours of the controller becoming aware of the incident.

An unregistered controller that suffers a breach may find itself unable to notify the regulator within the statutory window. That converts one compliance failure into two.

What overseas organisations will need

Overseas applicants should be prepared to provide:

1. a valid commercial registration (it remains to be confirmed how SDAIA treats a foreign registration for this purpose);
2. an appointed authorised representative to manage the registration; and
3. verification and digital-identity issuance through the Ministry of Foreign Affairs process for non-Saudi companies.

Once registration is complete, SDAIA issues a certificate valid for up to five years, renewable on expiry.

The cost of inaction

PDPL violations attract warnings or administrative fines of up to SAR 5 million, which may be doubled for repeat offences. Disclosure of sensitive data with intent to harm carries up to two years’ imprisonment and a fine of up to SAR 3 million. Beyond penalties, an unregistered controller faces delay in accessing SDAIA’s services precisely when it needs them most: during a breach or an investigation.

The regulatory framework is also tightening. SDAIA’s October 2026 consultation on amendments to the PDPL Implementing Regulation proposes to move the National Register and DPO rules into the Regulation itself, alongside a data localisation requirement and longer retention of processing records.

Recommended next steps

1. Map your Saudi data. Identify every activity that collects, stores, transfers or otherwise processes personal data of individuals in Saudi Arabia.
2. Assess the registration trigger. Determine whether your core activity, or your handling of sensitive data, brings you within the mandatory categories.
3. Appoint your people. Nominate an authorised representative and decide whether a DPO is required.
4. Prepare the documents. Assemble corporate documents and start the Ministry of Foreign Affairs verification early, as it can take time.
5. Build your breach playbook. Make sure you can notify SDAIA within 72 hours once registered.

How Alfi Legal can help

Alfi Legal advises local and international clients on Saudi data protection compliance. Our services include:

• PDPL applicability assessments and compliance gap reviews;
• registration on the National Data Governance Platform and DPO arrangements;
• designing the governance framework for exchanging sensitive data;
• data-sharing policies for affiliated group entities outside the Kingdom, and binding common rules for corporate groups;
• cross-border transfer analysis, transfer risk assessments and SDAIA-form standard contractual clauses;
• drafting and reviewing data processing agreements with service providers and processors;
• records of processing activities and data protection impact assessments;
• privacy notices, consent forms and legal-basis mapping for each processing activity;
• procedures for handling data subject rights requests; and
• breach-response planning and notification, and support during SDAIA inspections and investigations.

To discuss your position, contact us at Admin@alfilegal.com.

This article is for general information only and does not constitute legal advice.

هذا المقال لأغراض المعلومات العامة فقط ولا يُعدّ استشارة قانونية.