Saudi Arabia proposes in-Kingdom data storage and a 72-hour breach rule

As global enterprises expand their operations and deploy artificial intelligence systems across multiple jurisdictions, keeping pace with regulatory shifts is critical. For international professional services businesses and multinational corporations, understanding regional data protection frameworks is a fundamental component of maintaining robust AI compliance.

At Ops Intel, we monitor regulatory updates across key markets to help our clients navigate complex compliance obligations. Recent developments in Saudi Arabia highlight the dynamic nature of data protection and artificial intelligence governance in the Middle East, signalling important considerations for cross-border operations.

Saudi Data and Artificial Intelligence Authority Opens Public Consultation

On 6 October 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation, running until 5 November 2026, on proposed amendments to the Personal Data Protection Law (PDPL) Implementing Regulation.

For international organisations processing personal data in connection with AI systems or broader business operations in the region, monitoring these proposed changes is essential for future readiness. The consultation introduces several key modifications that could impact how global enterprises manage, store, and transfer data involving Saudi data subjects.

Key Proposed Changes Under the PDPL Implementing Regulation

The amendments published by SDAIA outline several proposed compliance requirements for data controllers operating within or interacting with the Kingdom:

• Local Data Storage: The proposals introduce a new requirement for data controllers to store personal data within Saudi Arabia, while still permitting transfers outside the Kingdom in accordance with the PDPL.
• Breach Notification Thresholds: The amendments would remove the existing harm threshold for notifying SDAIA of any breach, damage, or unauthorised access, introducing a strict requirement to notify the authority within 72 hours.
• Marketing Data Destruction: New requirements would oblige controllers to destroy data resulting from marketing processing when a data subject withdraws their consent.
• Expanded Cross-Border Transfer Registration: The proposals include an expanded registration requirement for any transfer or disclosure of personal data outside the Kingdom.
• Authority Response Timelines: A new 20-business-day period would be established for data controllers to respond to requests from SDAIA regarding the implementation of the PDPL.

Implications for International Professional Services and Global Enterprises

For multinational corporations and professional services firms, data flows rarely stop at national borders. AI models frequently rely on globally distributed datasets, cloud infrastructure, and cross-border collaboration.

The proposed introduction of mandatory local data storage within Saudi Arabia, coupled with stricter cross-border transfer registration requirements, means that international businesses must carefully review their data architecture. Furthermore, the removal of the harm threshold for 72-hour breach notifications to SDAIA underscores the need for agile, globally coordinated incident response mechanisms that can meet rapid reporting windows across multiple time zones.

Similarly, the proposed duty to destroy marketing-related data upon withdrawal of consent, alongside a proposed 20-business-day window to answer regulatory inquiries, highlights the importance of maintaining granular data mapping and prompt administrative response capabilities.

Prepare Your Organisation for Complex Compliance

As regulatory bodies continue to refine and update their data protection and artificial intelligence frameworks, global enterprises must remain proactive. Adapting to shifting regional mandates requires continuous monitoring, precise data governance, and strategic alignment between local operations and global compliance frameworks.

To find out how Ops Intel can support your business in meeting international AI compliance obligations and navigating multi-jurisdictional regulatory frameworks, visit Ops Intel.