Saudi PDPL Draft: In-Kingdom Data Storage and Your AI Projects

Saudi Arabia's data regulator has proposed that personal data be stored inside the Kingdom. The Saudi Data and Artificial Intelligence Authority (SDAIA) has published draft amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL). Public consultation runs from 6 October to 5 November 2026, according to a Clyde & Co briefing.

For anyone running AI on personal data in Saudi Arabia, the draft raises a practical question. Where do your prompts, chat histories, embeddings and logs actually sit? This article explains what the draft would change and what it leaves alone. It then compares cloud, on-premise and air-gapped AI, and ends with a checklist.

It is written for CIOs, CISOs, data protection officers and digital leaders at Saudi banks, insurers, hospitals, energy companies and government suppliers. It also covers international firms with Saudi clients.

This is general information, not legal advice. The draft may change before adoption. Check your own position with qualified Saudi counsel. We are Webify.AI, and we build private AI systems, so we have an interest in this topic. That is why every legal point below links to the regulator's text or a law-firm briefing.

What has SDAIA proposed?

SDAIA has proposed changes to the PDPL's Implementing Regulations, not to the law itself. The headline change is a new duty in Article 23 for controllers to store personal data inside the Kingdom. Transfers abroad would remain possible under the existing rules. The draft also tightens breach reporting, impact assessments and controller registration.

The PDPL was issued by Royal Decree No. M/19 in 2021 and amended in 2023. It became fully enforceable on 14 September 2024, after a one-year grace period (Clyde & Co). The Implementing Regulations sit under the law and set out the practical rules.

Clyde & Co's summary of the draft lists these proposed changes. The ones most relevant to AI projects are:

• Data localisation (Article 23): controllers would have to store personal data within the Kingdom. Transfers and disclosures abroad would still be allowed under the PDPL and its regulations.
• Registration (Article 34): registration on the National Register of Controllers would become mandatory for controllers that transfer or disclose personal data outside Saudi Arabia.
• Breach notification (Article 24): SDAIA would need notice within 72 hours of awareness, whether or not harm is likely.
• Impact assessments (Article 25): new triggers would include emerging technologies, automated decisions affecting people's rights, and large-scale or systematic monitoring.
• Regulator requests (new Article 36 Repeated): entities would have 20 business days to answer SDAIA's requests, with extensions at SDAIA's discretion.
• Privacy policies (new Article 18 Repeated): policies would need clear language that matches the language used to serve customers. Clyde & Co expects this to mean Arabic for most organisations.

What would change for data storage, and what would stay the same?

Today, Saudi law regulates transfers of personal data abroad but sets no general rule on where data is stored. The draft would add a storage rule on top of the transfer rules. Data could still be transferred lawfully, but controllers would also need to store personal data inside the Kingdom.

Cross-border transfers are governed today by Article 29 of the PDPL and SDAIA's Regulation on Personal Data Transfer Outside the Kingdom. Article 29 of the PDPL says a transfer must not harm national security or the Kingdom's vital interests. It also requires adequate protection abroad and limits transfers to the minimum data needed. The regulations can exempt controllers from these last two conditions.

The transfer regulation lists other permitted purposes. These include central processing operations, providing a service to the data subject, and scientific research. It provides for SDAIA to publish a list of countries with adequate protection. Where an exemption applies, the controller must use safeguards such as standard contractual clauses, binding common rules or an accreditation certificate (transfer regulation).

In March 2025, Clyde & Co reported that the adequacy list had not yet been issued. Clyde & Co said organisations must use safeguards such as standard contractual clauses until then. Under Article 7 of the transfer regulation, a risk assessment is required in some cases. These include transfers under the exemptions and continuous or widespread transfers of sensitive data.

Clyde & Co notes that firms using offshore hosting, regional infrastructure or cross-border services would need to review two things. One is their storage model. The other is the legal basis for each transfer.

Some things would not change, based on Clyde & Co's summary and the PDPL text:

• Transfers: still permitted where they meet the PDPL and its regulations.
• Notices to individuals: breach notices to data subjects would keep the existing damage-based test.
• Penalties: these sit in the law, which this draft does not amend. Article 36 provides for a warning or a fine of up to SAR 5 million, which can be doubled for repeat violations.

Current rules and the draft side by side

The table compares the two positions. Current registration triggers come from SDAIA's National Register rules. The draft column follows Clyde & Co.

When would the new rules take effect?

Not yet. The draft is open for comment until 5 November 2026. SDAIA will then review the feedback and decide whether to adopt it as drafted or with revisions. If approved, the amended regulations enter into force 60 days after publication in the Official Gazette. Clyde & Co's briefing gives no adoption date.

Those steps come from Clyde & Co's briefing. Sixty days is a short window to move AI systems, backups and logs to new locations. Data mapping and vendor reviews often take longer than that. Starting the inventory now costs little, and the work is useful even if the final rule changes.

Who would be affected?

Potentially every controller covered by the PDPL. The law applies to processing inside the Kingdom. It also applies to processing from abroad of data about people residing in the Kingdom. Banks, insurers, hospitals, energy firms and government bodies are all controllers in scope. Foreign firms with Saudi customers can be too.

That scope comes from Article 2 of the PDPL. In practice, the effect differs by sector:

• Banks and other financial firms: the PDPL preserves the powers of the Saudi Central Bank, so its rules apply alongside the PDPL (PDPL). Insurers should also check their own regulator's rules.
• Hospitals and health providers: health data is sensitive data under the PDPL (PDPL, Article 1). Controllers that process sensitive data must already register with SDAIA (National Register rules).
• Government bodies and critical infrastructure operators: these also follow the National Cybersecurity Authority's controls, covered in the next section.
• International firms: SDAIA now lets organisations outside Saudi Arabia register as controllers. Clyde & Co says this needs a valid commercial registration, an authorised representative and a Ministry of Foreign Affairs verification step (Clyde & Co).
• Suppliers and processors: the storage duty in the draft falls on controllers, but suppliers feel it through contracts. Article 17 of the Implementing Regulations already covers this. Processor agreements must state whether the processor is subject to other countries' laws, and name any subcontractors.

What do NCA controls already require for government and critical infrastructure?

Government agencies and critical infrastructure operators must already follow the National Cybersecurity Authority (NCA) controls. The 2024 versions removed their in-Kingdom hosting clauses. Data localisation moved to the National Data Management Office (NDMO) at SDAIA. The ECC still requires remote cybersecurity monitoring and operations centres to be located in the Kingdom.

The Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies, their affiliated companies, and private entities that own, operate or host critical national infrastructure. The NCA strongly encourages other entities to use them. Cloud and hosting controls bind entities that use, or plan to use, those services.

ECC-2:2024 deleted the earlier sub-control 4-2-3-3, which required hosting and storage inside the Kingdom. The ECC gives the reason: localisation controls moved to the NDMO. It tells entities to consult the NDMO on localisation before acting.

The Cloud Cybersecurity Controls (CCC-2:2024) made the same change. They dropped two controls that required providers to deliver cloud services from within the Kingdom, including storage, processing, disaster recovery, monitoring and support systems. CCC applies to government and critical infrastructure cloud customers, and to the cloud providers that serve them.

ECC-2:2024 keeps control 4-1-3-2. Cybersecurity managed service centres that monitor and operate systems through remote access must be fully located in Saudi Arabia (ECC). If an AI vendor offers remote monitoring from abroad, check whether this control applies.

The PDPL rules already link the two regimes. Current Article 23 of the Implementing Regulations requires controllers to adopt NCA controls where they apply. Controllers outside the NCA's scope must follow recognised cybersecurity standards instead.

Procurement context: the regional headquarters rule

One more rule shapes who can serve government buyers, though it concerns procurement, not data. Since 1 January 2024, government agencies generally may not contract with companies that lack a regional headquarters in the Kingdom. Exemptions include procurements valued below SAR 1 million and cases with only one technically acceptable offer (CMS).

Where does personal data go in an AI system?

Into more places than the main database. A chatbot or AI agent copies personal data into prompts, model outputs, conversation history, retrieval indexes, logs, test sets and backups. Each copy has a storage location. Under the draft, each location would need checking against the in-Kingdom storage rule.

The PDPL defines personal data broadly. It covers any data that may directly or indirectly identify a person, including ID numbers, contact details, records, photos and videos (PDPL, Article 1). Scanned ID cards, call transcripts and customer emails sent to an AI system usually fit that definition.

Common places personal data ends up in an AI stack:

• Prompts and uploads: the text, documents and images users send to the model.
• Outputs: summaries, drafts and decisions that repeat or infer personal details.
• Conversation history: stored chats that let users resume a session.
• Embeddings and vector indexes: numeric versions of documents used for retrieval. Treat them as personal data unless you can show they cannot identify anyone.
• Logs and traces: request logs, debugging traces and monitoring tools, often run by third parties.
• Training and test sets: examples copied out for fine-tuning or evaluation.
• Backups and recovery copies: often kept in a different region from production.

SDAIA's risk assessment guideline for transfers asks controllers to record the exact country of storage, including backups. It also lists remote access, storage abroad and processing abroad as forms of transfer. The guideline says it is not legally binding, but it shows how the regulator approaches the question.

SDAIA's generative AI guidelines for the public add a usage point. They advise organisations to set policies that stop staff entering classified information into third-party AI tools.

What does the draft mean for AI APIs hosted abroad?

Sending personal data in prompts to a model hosted outside the Kingdom is already a transfer under current rules. It needs a permitted purpose, adequate protection or approved safeguards, and sometimes a risk assessment. The draft would add two things: a duty to store personal data in the Kingdom, and registration for controllers that transfer data abroad.

SDAIA's risk guideline lists processing abroad as a form of transfer. The draft's additions come from Clyde & Co's summary. For a foreign-hosted API, the hard questions are about copies. Does the provider keep prompts or outputs, for how long, and in which country? Do your chat history and vector stores sit in your own Saudi environment or with the vendor? The answers belong in the contract.

It is not yet clear how the final rule will treat short-lived processing abroad. An example is a model that reads a prompt, returns an answer and keeps nothing. The draft keeps transfers permitted, which suggests such processing could continue under the transfer rules. That is our reading, and the final text or SDAIA guidance should settle it.

Practical steps if you keep a foreign-hosted API:

• Minimise: send only what the task needs. Article 29 of the PDPL already limits transfers to the minimum personal data needed.
• Redact or pseudonymise: remove names, ID numbers and account numbers before the call where the task allows.
• Keep stored copies at home: hold chat history, embeddings and logs in a Saudi environment you control.
• Document the transfer: use a safeguard such as SDAIA's standard contractual clauses, and run the risk assessment where required (transfer regulation).
• Plan for registration: if the draft passes as written, controllers that transfer data abroad would need to register.

What about cloud regions inside Saudi Arabia?

For most organisations, an in-Kingdom cloud region is the simplest route to in-Kingdom storage. Oracle and Google Cloud already run regions in Saudi Arabia. Microsoft and AWS have announced Saudi regions for November and December 2026. Check that the AI services you need run in the region, not only the storage.

Here is what each provider's own pages say. Other providers operate in Saudi Arabia too, and this list covers only the regions we checked.

• Oracle: its region list includes Saudi Arabia Central in Riyadh and Saudi Arabia West in Jeddah.
• Google Cloud: the Dammam region (me-central2) is live. Saudi-based customers buy it through CNTXT, Google's exclusive reseller in the Kingdom (Google Cloud).
• Microsoft: on 31 August 2026, Microsoft said its Saudi Arabia East region in the Eastern Province will open to customers in November 2026 (Microsoft). It describes local data residency for eligible workloads.
• AWS: AWS says its first Saudi region is on track to launch in December 2026 (AWS). With HUMAIN, a company owned by the Public Investment Fund, it plans up to 50 MW of capacity in an AI Zone by 2028.

AWS also says HUMAIN's ALLaM Arabic model will soon be available through Amazon Bedrock (AWS). Until the Microsoft and AWS regions open, treat their dates as plans, not facts.

A region is a location, not a guarantee. AI models and tools are not always offered in every region. Microsoft's announcement itself refers to eligible workloads and supported services. Confirm in writing where inference runs, where logs go, and where support staff connect from.

Cloud also means shared responsibility. You still set retention, access and encryption. The provider's staff and sub-processors may also sit outside the Kingdom, which raises the same transfer questions as an API.

When does on-premise or air-gapped AI make sense?

It makes sense for highly sensitive or classified data, and for critical infrastructure. It also suits teams that want no third party in the data path. On-premise AI keeps models, prompts and logs on your own hardware. Air-gapped AI goes further, with no network link to the internet. Both take more effort to run than cloud.

Open-weight models make this practical. ALLaM 7B Instruct (preview), published by HUMAIN, is released under the Apache 2.0 licence on Hugging Face. So are Jais 2, QCRI's Fanar and IBM's Granite 4.0. The first three target Arabic and English.

The trade-offs are real. You buy and run GPU servers, patch the software stack and update models yourself. Models that fit on a few GPUs are smaller than the largest hosted models. They suit focused tasks such as document search, extraction and drafting. Air-gapped systems also need a controlled way to bring in updates.

Deployment options compared

The table compares four common options. It is a starting point for design decisions, not a compliance verdict.

What should an AI project checklist cover?

Start with a data map, then follow every copy of personal data through the AI system. Check prompts, outputs, embeddings, logs, backups and support access. Then match each copy to a location, a legal basis and a contract term. The list below is a working checklist, not a complete compliance programme.

• Data map: list each AI use case, the personal data it touches, and whether any of it is sensitive.
• Prompts and uploads: record where requests are processed and whether the model provider keeps them.
• Conversation history: decide where chats are stored and how long you keep them.
• Embeddings and vector stores: host retrieval indexes in the Kingdom if the source documents contain personal data.
• Logs and monitoring: check observability, tracing and analytics tools, which are often hosted abroad.
• Backups and recovery: confirm the location of backup and disaster recovery sites, not just production.
• Model hosting: write down where each model runs, which version it is, and who can change it.
• Vendor contracts: cover the points in Article 17 of the Implementing Regulations, including foreign legal exposure, subcontractors and breach notice.
• Remote support: list who can reach your systems from abroad, and how that access is approved and logged.
• Transfers: record each cross-border flow, its purpose and safeguard, and whether a risk assessment is required.
• Registration: check the current triggers and the draft's new trigger for controllers that transfer data abroad (Clyde & Co).
• Impact assessments: plan for them on AI projects, since the draft would require them for emerging technologies and automated decisions.
• Breach readiness: test whether you and your AI vendors could report to SDAIA within 72 hours.
• Arabic privacy notices: check that chatbot and app notices use the language you serve customers in.
• Staff rules: set a clear policy on what data staff may paste into public AI tools.

How can you respond to the consultation?

Organisations and individuals can comment through Istitlaa, Saudi Arabia's public consultation platform, until 5 November 2026. Useful comments cite the article, explain the practical effect and propose wording. AI users are well placed to explain how a storage rule would apply to prompts, logs and embeddings.

The submission route and deadline come from Clyde & Co. Points that AI users may want to raise include:

• Meaning of store: does the duty cover a primary copy only, or every copy, including backups and caches?
• Short-lived processing: does inference abroad, with nothing retained, count as storage?
• Derived data: how should embeddings, logs and model outputs be treated?
• Transition: is 60 days after publication enough time to move systems and change contracts?
• Registration: what would controllers that transfer data abroad need to file, and when?

Read the official draft on Istitlaa before you submit. Summaries, including ours, can miss details that matter for your case.

How can Webify.AI help?

Webify.AI is an AI and software company headquartered in Ahmedabad, India, and an IBM Partner. We build private AI deployed air-gapped, on-premise or in an in-country cloud. We use open-weight models such as IBM Granite, and Arabic models such as ALLaM, Jais and Fanar.

We also build AI agents, and we offer fixed-price pilots. A pilot lets you test one use case before a larger commitment. In an on-premise or air-gapped deployment, models, prompts and logs stay on your hardware. Agree with us up front how support works, including whether any remote access is allowed.

Two honest limits apply. We are not a law firm, so pair any project with your own legal advice. We also hold no security certifications, so your security team should review the design against your own controls and NCA obligations.

To see how this works in practice, read about private AI and our offline LLM development service.

Sources

• Clyde & Co, The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL (8 October 2026)
• Clyde & Co, SDAIA opens controller registration for overseas organisations (8 October 2026)
• Clyde & Co, Update on Saudi Arabia risk assessment guidelines (18 March 2025)
• SDAIA, Personal Data Protection Law
• SDAIA, Implementing Regulation of the Personal Data Protection Law
• SDAIA, Regulation on Personal Data Transfer Outside the Kingdom (August 2024)
• SDAIA, Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom (February 2025)
• SDAIA, Rules Governing the National Register of Controllers Within the Kingdom
• SDAIA, Generative Artificial Intelligence Guidelines for Public (2025)
• National Cybersecurity Authority, Essential Cybersecurity Controls, 2024 edition
• National Cybersecurity Authority, Cloud Cybersecurity Controls, 2024 edition
• CMS, Saudi Arabia regional headquarters update (24 June 2024)
• Microsoft, Saudi Arabia East datacenter region available in November 2026 (31 August 2026)
• Amazon, AWS cloud region in Saudi Arabia
• Oracle, OCI regions and availability domains
• Google Cloud, Dammam region access
• Hugging Face, ALLaM-7B-Instruct-preview
• Hugging Face, Jais-2-8B-Chat
• Hugging Face, Fanar-1-9B-Instruct
• Hugging Face, granite-4.0-h-small