Saudi Arabia: Saudi Data and AI Authority closes consultation on proposed amendments to the Implementing Regulation of Personal Data Protection Law including registration requirements for data controllers

On 27 May 2025, the Saudi Arabian Authority for Data and Artificial Intelligence (SDAIA) closes its consultation for a proposed amendment to the Implementing Regulation of the Personal Data Protection Law (PDPL). In particular, the amendment would require controllers to register in the National Register of Controllers through the Competent Authority’s platform if they met certain conditions, such as being a public entity, primarily engaging in Personal Data processing, transferring data outside the Kingdom, or handling sensitive or vulnerable individuals’ data. Each Controller would have a separate register where records of processing activities and related documents would be maintained. This obligation would also apply to individuals if they processed Personal Data for purposes beyond personal or family use.