Saudi Personal Data Protection Law and automated decisions

What it is

The Personal Data Protection Law is Saudi Arabia’s general data protection law. It was issued by Royal Decree No. M/19 in September 2021, amended by Royal Decree No. M/148 in March 2023, and came into force on 14 September 2023. Organisations had a year to bring their processing into line, and the Law has been fully enforceable since September 2024.

The Law sets the principles and the rights. The Implementing Regulation, issued by SDAIA and in force from the same date as the Law, fills in the detail, and that is where automated decisions appear by name. SDAIA, the Saudi Data and AI Authority, is the competent authority, and its specialised committees examine violations and impose penalties.

Who it applies to

Article 2 applies the Law to any processing of personal data about individuals that takes place in the Kingdom, by any means. It also applies to processing of personal data about individuals residing in the Kingdom by any party outside the Kingdom. Purely personal or family use is excluded.

The Law uses the familiar roles. A controller decides the purpose and means of processing, and a processor processes personal data on its behalf. Public entities, companies and individuals can all be controllers. A Saudi bank using a vendor’s AI model to score credit applications is the controller for those decisions, and the vendor is usually its processor.

What it requires

For AI systems, the provisions that matter most are these.

• Explicit consent for solely automated decisions. Consent is the default basis for processing under Article 5 of the Law. Article 11(2)(c) of the Implementing Regulation says consent must be explicit when decisions are made solely based on automated processing of personal data.
• Notice that automated decisions will be made. Article 4(5) of the Implementing Regulation says a controller whose activities include making automated decisions based on personal data must tell people, in addition to the standard notice, how it protects their data and whether decisions will be made solely by automated processing.
• Impact assessment. Article 22 of the Law requires an impact assessment of processing for any product or service. Article 25 of the Implementing Regulation makes a written, documented assessment mandatory in listed cases, including where the controller’s activity includes processing based on newly adopted technologies or making decisions based on automated processing. The assessment must cover the purpose and legal basis, the nature, scope and context of the processing, necessity and proportionality, the likely impact on people and the measures taken to reduce the risks.
• Privacy policy. Article 12 of the Law requires a privacy policy, available before collection, that sets out the purpose, the data collected, how it is processed, stored and destroyed, and how people can exercise their rights.
• Accuracy and rights. People can be informed, access their data, obtain a copy, and ask for correction, completion, updating or destruction. Controllers answer requests within the period set by the Implementing Regulation, which is 30 days with one extension.
• Breach notification. Article 24 of the Implementing Regulation requires notice to SDAIA within 72 hours of becoming aware of a breach that could harm the personal data or the people it relates to, and notice to those people where it could cause them damage.
• Transfers outside the Kingdom. Article 29 of the Law and SDAIA’s separate transfer regulation set the conditions for sending personal data abroad.

For an AI system that makes decisions about people, the practical questions are which systems decide on their own, whether the consent behind them is explicit, whether the privacy notice says so, and whether an impact assessment covers each one before it goes live.

Key dates

• September 2021. Law issued by Royal Decree No. M/19.
• March 2023. Law amended by Royal Decree No. M/148.
• 7 September 2023. SDAIA issues the Implementing Regulation and the regulation on transfers outside the Kingdom.
• 14 September 2023. Law and Implementing Regulation in force, with a one-year grace period.
• September 2024. Grace period ends and the Law is fully enforceable.
• 6 October 2026. SDAIA publishes draft amendments to the Implementing Regulation for public consultation on the Istitlaa platform, open until 5 November 2026. Published commentary reports that the draft would add solely automated decisions affecting people’s rights or interests, and the use of emerging technologies, to the impact assessment triggers, and would add a duty to store personal data in the Kingdom. If adopted, the amendments take effect 60 days after publication in the Official Gazette.

How it relates to other frameworks

The PDPL takes a different route from GDPR Article 22. It does not give a standalone right not to be subject to a solely automated decision. It handles automated decisions through explicit consent, notice and a mandatory impact assessment. Within the Gulf, the UAE PDPL gives a right to object to automated decisions instead.

The PDPL is the binding layer for AI that processes personal data in Saudi Arabia. SDAIA’s AI Ethics Principles sit on top of it, with risk levels and controls across the AI lifecycle. An AI impact assessment built to ISO/IEC 42001 or the NIST AI RMF covers much of what Article 25 asks for, provided it addresses the rights of the people whose data is processed.

A note on this page

This is Aicura’s reading of the Law and its Implementing Regulation in the English translations SDAIA publishes. It is not legal advice and it is not the law itself. The Arabic text is authoritative. Read the primary sources on SDAIA’s site, watch for the outcome of the 2026 consultation, and take advice on how the PDPL applies to your organisation.