Hada News
SDAIA puts draft PDPL Implementing Regulations amendments on Istitlaa until 5 November
Saudi Arabia's data authority has opened a public consultation on revisions to the Personal Data Protection Law's Implementing Regulations. Comments go through the Istitlaa platform; SPA and Sabq say the window closes on 5 November 2026. This is separate from the personal-data sandbox story already covered this week.
The Saudi Data and Artificial Intelligence Authority (SDAIA) has placed draft amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL) on the national Istitlaa consultation platform. The Saudi Press Agency reported on 8 October that the project is among 40 consultation files opened with 25 government bodies, and that the SDAIA file closes on 5 November 2026. Sabq carries the same closing date.
SPA says SDAIA wants the rules to be easier to follow: the draft spells out procedures and controls more clearly for the organisations and individuals the law covers, and names personal-data protection and public trust in data-driven services as its goals. Clyde & Co and Bird & Bird, in notes dated 8 October and published after the draft appeared, both date the consultation from 6 October to 5 November. Clyde & Co adds that, if adopted, the amended regulations would take effect 60 days after publication in the Official Gazette — a timing detail from the law firm's note, not from the SPA brief.
Bird & Bird notes this is a further round: SDAIA consulted on an earlier draft in April 2025 that, as far as the firm is aware, was never finalised, and the revised text goes further. Counsel digests highlight operational themes under discussion, including storage of personal data in the Kingdom with transfers still subject to PDPL rules, notifying SDAIA of any breach within 72 hours whether or not harm is likely, simplified language for privacy notices, streamlining of records of processing, and a proposed 20-business-day response window for certain SDAIA information requests. Those points come from law-firm reads of the draft text, not from a line-by-line SPA extract; controllers should verify against the Istitlaa file itself before commenting.
Why it matters: for product, legal and security teams already implementing the PDPL, a month of consultation is the chance to flag operational friction before the text hardens. Because this week's earlier Hada item covered SDAIA's personal-data sandbox, readers should treat this as a different instrument — regulations practice, not a sandbox programme.
Sources: Saudi Press Agency, 8 Oct 2026 (N2696345); Sabq; Clyde & Co and Bird & Bird client notes (Oct 2026).
Watch next: whether SDAIA publishes a response summary after 5 November, and the Official Gazette date if the amendments are adopted.