Saudi PDPL and AI Tools: Lawful Basis, Transfers and the DPO
What the Saudi PDPL means when staff paste data into AI tools and when AI vendors serve Saudi clients: lawful basis, transfers abroad, the DPO and the 2026 draft changes.
A common mistake with the Saudi PDPL and AI tools is to treat a prompt as something the law does not see. Under Saudi Arabia's Personal Data Protection Law, pasting a customer's name, phone number or complaint into an AI assistant is processing personal data. If the tool runs on servers outside the Kingdom, it can also be a transfer abroad. We recommend settling three questions for each AI tool before you write any staff guidance: which lawful basis covers the use, which transfer route applies, and who in your organisation answers for it.
This is general information, not legal advice. Your obligations depend on your sector, the data you hold and whether a sector regulator such as the Saudi Central Bank also supervises you.
Does the PDPL apply when staff paste data into an AI tool?
Yes, whenever the prompt contains personal data. The Personal Data Protection Law, issued by Royal Decree No. M/19 dated 9/2/1443H and amended by Royal Decree No. M/148 dated 5/9/1444H, defines processing as any operation on personal data. That list includes collecting, storing, using, disclosing and transmitting. Article 2 also covers processing of data about people residing in the Kingdom by any party outside it.
The law splits roles in two. Your organisation is the controller: it decides why and how the data is used. An AI vendor that handles data on your behalf and under your instructions is a processor. Article 8 says the controller may only choose processors that give sufficient guarantees, and must monitor their compliance. The vendor's terms do not move that duty away from you.
One exception is narrow. Article 2 excludes personal or family use, as long as the data is not published or disclosed to others. An employee drafting a reply to a client at work is not personal use.
Which lawful basis covers AI use under the PDPL?
Consent is the default. Article 5 says data may not be processed, and its purpose may not be changed, without the data subject's consent, except in the cases the law lists. Article 6 lists those cases, including processing under another law, under an agreement the person is party to, and for the controller's legitimate interest.
The Implementing Regulation of the PDPL sets tight conditions on legitimate interest in Article 16. Public entities cannot use it. The processing must not include sensitive data, must stay within the person's reasonable expectations, and needs a documented assessment before it starts. Article 11 adds that consent must be explicit when decisions are made solely by automated processing.
| AI use | Basis to test first | What to watch |
|---|---|---|
| Drafting replies to a customer's own request | Agreement with the customer (Article 6) | Send only what the reply needs |
| Fraud or security alerts | Legitimate interest (Regulation Article 16) | Written assessment first; not for public entities |
| Reusing old records to train or tune a model | New purpose: consent or a fresh basis (Article 5) | Tell people before the new processing |
| Fully automated screening of applicants | Explicit consent (Regulation Article 11) | Impact assessment under Regulation Article 25 |
| Anything with health or biometric data | Explicit consent or a specific legal basis | Legitimate interest is not available |
An illustrative example: a family-owned retail chain in Riyadh wants staff to use an AI assistant to summarise customer complaints. The complaints were collected to resolve the customer's issue, so summarising them for that purpose fits the original agreement. Feeding the same archive into a marketing model is a new purpose, and it needs a new basis.
Transfers outside the Kingdom when the AI vendor is abroad
Article 29 of the law allows transfer or disclosure abroad only for listed purposes and under conditions. The transfer must not harm national security or the Kingdom's vital interests. The receiving country must offer protection at least equal to the law, and only the minimum data needed may leave.
The Regulation on Personal Data Transfer Outside the Kingdom (version 2.0, August 2024) fills in the detail:
- Purposes. Article 2 adds central processing for the controller's activities, providing a service or benefit to the data subject, and scientific research.
- Adequate countries. Article 3 says the competent authority publishes a list of countries with appropriate protection. Check SDAIA's site for the current list before relying on it.
- Safeguards. Where an exemption applies, Article 4 requires standard contractual clauses, binding common rules or a certificate of accreditation.
- Risk assessment. Article 7 requires a written assessment before transfers under those exemptions, and before continuous or widespread transfers of sensitive data.
- Onward transfers. Article 5 keeps the law in force when a vendor passes the data on to its own sub-processors.
Watch one change in progress. SDAIA opened a public consultation on draft amendments to the Implementing Regulation, running from 6 October to 5 November 2026. According to an October 2026 summary by Clyde & Co, the draft would add an express duty to store personal data inside the Kingdom while still allowing lawful transfers. It is a draft, not law, and the final text may differ. Ask counsel how it could affect any AI tool you plan to contract for more than a year.
Do you need a data protection officer for AI?
Using AI does not by itself trigger the duty. Article 32 of the Implementing Regulation requires a data protection officer in three cases: a public entity providing services with large-scale processing, core activities that need regular and systematic monitoring of people, or core activities based on sensitive data. The officer may be an executive, an employee or an external contractor.
The officer's listed duties include supervising impact assessments and keeping the records of processing up to date. For AI, that makes the officer the natural approver of new tools. Article 25 lists the cases that need a written impact assessment. They include sensitive data and, where the controller's activity involves large-scale and repeated processing, newly adopted technologies and automated decisions. SDAIA also publishes separate Rules for Appointing a Personal Data Protection Officer in its PDPL knowledge centre.
A second illustrative example: a clinic group in Jeddah wants an AI scribe to draft visit notes. Health data is sensitive, so its core activity already points to a data protection officer. The scribe needs an impact assessment, explicit consent or another specific basis, and a transfer review if audio is processed abroad.
What AI vendors selling into Saudi Arabia should prepare
If you sell an AI product to Saudi customers, expect their procurement team to test you against Article 17 of the Implementing Regulation. That article lists what the controller's agreement with a processor must contain. Prepare these answers in writing:
- The purpose, data categories and duration of processing.
- How fast you notify the customer of a breach. Under Article 24, the customer itself must notify the competent authority within 72 hours of becoming aware of a breach that may cause harm.
- Whether laws in other countries apply to you, and how they affect compliance.
- A named list of sub-processors, with prior notice and a right for the customer to object before you add one.
- Where data, prompts and logs are stored, and whether they are used to train models. Article 17 does not list this, but customers need it for their transfer review.
Article 17 also says a processor that breaks the controller's instructions is treated as a controller and held directly accountable. An illustrative case: a software firm in Amman sells AI-based CV screening to Saudi employers. Its product makes decisions on people residing in the Kingdom, so the law reaches it through Article 2, and its customers will ask about explicit consent for automated decisions.
A staff checklist for the Saudi PDPL and AI tools
SDAIA's Generative AI Guidelines for Public (2025) advise organisations to adopt usage policies that stop users from entering classified information into third-party tools. They also say existing duties, including personal data protection, still apply when staff use these tools. Turn that into a short checklist:
- Use only tools on the approved list, each with a recorded lawful basis and transfer route.
- Remove names, ID numbers and contact details unless the task needs them.
- Never paste health, biometric or credit data, or other sensitive data, into a general assistant.
- Do not let a tool make a final decision about a person without human review and the consent the law requires.
- Report a wrong upload to the data protection officer or privacy contact the same day, so the 72-hour clock can be managed.
Our guide to finding shadow AI tools your staff already use helps you build the approved list. The AI acceptable use policy template gives you the wording for staff. The stakes are real: Article 36 of the law allows a warning or a fine of up to SAR 5 million for violating the law or its regulations, and the fine may be doubled for a repeat violation.
How to start
Start with an inventory of the AI tools in use, then record a lawful basis, transfer route and responsible person for each. Our AI Governance & Compliance Foundation covers policy, registers and PDPL alignment as part of the Governance Lab. Our page on PDPL and regulators explains how we approach it. If you want a first view, book the free AI Exposure Scan: a 45-minute conversation that ends in a written next step.
Frequently asked questions
Is using ChatGPT or Claude at work a breach of the Saudi PDPL?
Not by itself. The breach risk comes from what staff put into the tool. Entering personal data is processing under the law, so it needs a lawful basis, and a tool hosted outside the Kingdom can make it a transfer under Article 29. Organisations reduce the risk by approving specific tools, recording a basis and transfer route for each, and telling staff which data never goes in.
Does the Saudi PDPL require personal data to stay in Saudi Arabia?
The law in force allows transfers abroad for listed purposes and under conditions in Article 29 and the transfer regulation, such as adequate protection or safeguards like standard contractual clauses. A draft amendment to the Implementing Regulation, open for consultation until 5 November 2026, would add an express duty to store data inside the Kingdom. It is not law yet, so check its status with counsel.
When does an AI project need a PDPL impact assessment?
Article 25 of the Implementing Regulation requires a written impact assessment in listed cases, including processing sensitive data, linking datasets from different sources and, where the controller's activity involves large-scale and repeated processing, newly adopted technologies or automated decisions. The assessment covers purpose and legal basis, the data involved, necessity, likely harm and the measures to reduce it. The controller shares a copy with its processors.
Does an AI vendor outside Saudi Arabia have to follow the PDPL?
Article 2 of the law covers processing of data about people residing in the Kingdom by any party outside it. A foreign AI vendor that processes data on a Saudi customer's behalf is a processor, and the customer must bind it to the terms in Article 17 of the Implementing Regulation, including breach notice, sub-processor approval and disclosure of foreign laws that apply to it.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Governance Lab ↗
