Saudi Arabia: Saudi Data and AI Authority opened consultation on proposed amendments to Implementing Regulation of Personal Data Protection Law including registration requirements for data controllers

On 27 April 2025, the Saudi Arabian Authority for Data and Artificial Intelligence (SDAIA) opened a consultation on the proposed amendments to the Implementing Regulation of the Personal Data Protection Law (PDPL) until 27 May 2025. In particular, the amendment would require controllers to register in the National Register of Controllers through the Competent Authority’s platform if they met certain conditions, such as being a public entity, primarily engaging in Personal Data processing, transferring data outside the Kingdom, or handling sensitive or vulnerable individuals’ data. Each Controller would have a separate register where records of processing activities and related documents would be maintained. This obligation would also apply to individuals if they processed Personal Data for purposes beyond personal or family use.