Foreign companies without a presence in the Kingdom of Saudi Arabia that are covered by the Personal Data Protection Law must now register with SDAIA.

By Brian A. Meenagh, Danielle van der Merwe, and Faisal Imam

The Saudi Data and Artificial Intelligence Authority (SDAIA) has opened its National Data Governance Platform to organisations outside the Kingdom of Saudi Arabia (Kingdom), enabling foreign controllers to register for the first time. The Saudi Data and Artificial Intelligence Authority (SDAIA) has opened its National Data Governance Platform to organisations outside the Kingdom of Saudi Arabia (Kingdom), enabling foreign controllers to register for the first time. The development is relevant to organisations that process personal data of individuals residing in the Kingdom and that may be subject to registration requirements of the Personal Data Protection Law (PDPL).

Link to The Registration Requirement The Registration Requirement

Under SDAIA’s Rules Governing the National Register of Controllers (the Registration Rules), controllers within the scope of the PDPL must register on SDAIA’s National Data Governance Platform (the Platform) where the relevant registration thresholds under the PDPL are met. This includes where the controller’s main activity is based on processing personal data, or where the controller processes sensitive data.

Although foreign companies could trigger the requirement to register, in practice they have been unable to do so, as registration through the Platform required a KSA-issued commercial registration number. The Registration Rules themselves only cover controllers within the Kingdom, and state that separate rules for controllers outside the Kingdom will be issued.

Link to What Has Changed What Has Changed

SDAIA has now added a “Registration of External Entities” service to the Platform, allowing entities outside the Kingdom to register and obtain a National Register for Personal Data Protection Certificate. Registration involves a two-stage process: authentication through the Ministry of Foreign Affairs, followed by registration on the Platform itself. As the service is new, the process remains largely untested in practice.

Link to More Change on the Horizon More Change on the Horizon

SDAIA’s proposed amendments to the PDPL Implementing Regulation, currently under public consultation until 5 November 2026, would also expand the registration triggers. If adopted, registration would be required where a controller transfers personal data outside the Kingdom or transfers that data to entities outside the Kingdom. This potentially broad trigger is likely to capture many international organisations.

Link to Why This Matters Why This Matters

  • Registration obligations. Foreign entities that are subject to the PDPL and meet the registration thresholds now need to register.
  • Enforcement exposure. Breaches of the PDPL or its Implementing Regulation can lead to a warning or a fine of up to ⃁5 million (approximately $1.33 million), which may be doubled for repeat violations. Penalty decisions may also be published at the violator’s expense, creating a real “name and shame” risk.
  • Breach notification. Personal data breaches are notified to SDAIA through the Platform. Without a Platform account, a foreign entity may not be able to meet its breach notification obligations under the PDPL.

Link to What Businesses Should Do Now What Businesses Should Do Now

Organisations that process personal data of individuals in the Kingdom, but have no presence there, should assess whether the PDPL applies to them, determine whether they meet the applicable registration thresholds, and prepare to complete the new registration process where required.

For more information, please contact a member of our team.