Saudi PDPL draft amendments: in-Kingdom storage, a 72-hour breach notice and what to map now

SDAIA's draft amendments to the Saudi Personal Data Protection Law (PDPL) Implementing Regulation, on which it invited comments on 6 October 2026, would require controllers to store personal data inside the Kingdom, report every breach within 72 hours and answer the authority within 20 business days. It is a draft. Start by mapping where your personal data sits.

What changed. 6 October 2026: the Saudi Data and AI Authority (SDAIA) invited comments on the draft through Istitlaa, the government's consultation platform. This page reads its proposed text against the current text, as of 31 October 2026.

What the draft changes, at a glance

The Istitlaa page shows each article's proposed text next to the current one. The changes that reach an ERP system:

The SPA (Saudi Press Agency) announcement says the amendments aim to clarify the regulation's procedures and controls and its provisions on storing personal data.

In-Kingdom storage: what the text says, and what it leaves open

Proposed Article 23(2) is one sentence: the controller must store personal data inside the Kingdom, and may transfer it abroad or disclose it to a party abroad in accordance with the law and its regulations.

Two points follow from the wording:

• The transfer route stays. The second half keeps transfers and disclosures abroad possible under the law's rules, but the text does not say how the two halves work together.
• The copy question is open. The text does not say whether keeping one copy in the Kingdom satisfies the duty when the same data is also processed abroad. Get advice before you move or duplicate systems.

As in the current text, the article also asks controllers to follow the National Cybersecurity Authority's (NCA) controls where they apply, or recognised security practice where they do not. Other rules may already limit where some data goes; this page covers only this draft.

The 72-hour breach clock

Under the draft, the clock starts when the controller learns of the incident, not when it happened, and it runs in hours, not business days.

The notice describes what happened and when, who and which data are affected (actual or approximate numbers), the risks and the measures taken, whether the people were or will be told, and a contact. Anything you cannot give within 72 hours follows as soon as possible, with the reasons for the delay. NCA reporting duties stay in place beside it. People whose data is affected are told without undue delay where the incident could harm them.

Plan for an incident found on a weekend: name who decides and who files before you need them.

What to map now: a checklist

Whatever the final text says, a data map is the first step: know where personal data is. Proposed Article 33 keeps the record of processing for as long as processing lasts plus five years after each activity ends, accurate and available to the authority on request; it also drops the current article's list of minimum contents.

Then three short tasks:

1. Name an owner for each system on the list, and a data protection officer if one of the draft's cases applies to you.
2. Write the breach runbook: who decides that an incident is notifiable, who files, who tells the people affected, and how a weekend call reaches them.
3. Check your marketing consent. Proposed Article 29 says that when someone withdraws consent to marketing, you stop that processing and destroy the data it produced without undue delay.

To have your say, the Istitlaa page offered a comment form under each article when we checked on 31 October 2026; it showed no closing date.

How Tarleaks helps

The Tarleaks HR app keeps a data request queue with due dates and a breach log with detected and reported times, and CRM keeps a marketing consent record with every withdrawal. Each company has its own database; our security page lists four places your data can live, and the Security app keeps a personal-data audit log. This is evidence for your assessment, not a certification.

What to do next

• Read why Tarleaks is built in Rust for how one database per company and the audit trail work.
• Running payroll in Saudi Arabia too? See Saudi payroll with Mudad, GOSI and Qiwa.
• Book a demo and we go through the data-location options with your questionnaire.

Questions people ask

Does the Saudi PDPL now require data to be stored in the Kingdom?

Not under this draft yet. Proposed Article 23(2) in SDAIA's draft amendments says a controller must store personal data inside the Kingdom and may transfer it abroad under the law's rules. Until a final text is published in the Official Gazette, the current regulation applies, and other rules may already limit where some data goes: ask your adviser.

How fast must a data breach be reported under the draft?

Within 72 hours of the controller learning of a leak, damage or unlawful access, to the competent authority. The current text asks for the 72-hour notice only where the incident could cause harm; the draft drops that condition. Individuals are told without undue delay where the incident could harm them.

When would the amendments apply?

Proposed Article 38 says 60 days after publication in the Official Gazette. SDAIA invited comments on 6 October 2026; no final text had been published when we checked on 31 October 2026.

Can personal data still leave Saudi Arabia under the draft?

The draft keeps transfers and disclosures abroad possible under the law and its regulations, next to the new storage duty. It does not say whether keeping a copy in the Kingdom is enough when data is also processed abroad, so ask your adviser how it applies to your systems.

Where does Tarleaks store data?

You choose among four options listed on our security page: our cloud with a database for your company, your own storage bucket, your own database, or your own servers. The location of our cloud is not published there yet, so ask us in a security walkthrough.

---

General information, not legal advice. Checked against the official sources listed on this page on 31 October 2026. The amendments are a draft: confirm your position with SDAIA or your adviser.