SDAIA Proposes PDPL Regulation Amendments: What CCTV Operators Should Watch
The Saudi Data and AI Authority (SDAIA) has put draft PDPL implementing regulation amendments, changes to the Implementing Regulation of the Personal Data Protection Law, to public consultation on the Istitlaa platform. The draft was published on 6 October 2026, according to law firms Clyde & Co and Reed Smith. The official gazette Umm Al-Qura reported on 8 October 2026 that the consultation ends on 5 November 2026 and that the aim is to clarify the procedures and controls in the regulation so that the entities and individuals it covers can comply.
Key takeaways
- This is a draft, open for comment until 5 November 2026. It is not binding until the final text is approved and published.
- According to law firm summaries, controllers would store personal data inside the Kingdom, while transfers abroad remain possible under the law.
- According to the same summaries, impact assessments would be needed in new cases, including large-scale processing or regular or systematic monitoring.
- Clyde & Co says breaches would be reported to SDAIA within 72 hours without a likely-harm threshold.
Main PDPL implementing regulation amendments proposed
Umm Al-Qura did not publish the amended articles. The details below come from summaries by Clyde & Co, Reed Smith and Al Tamimi & Company published between 8 and 16 October 2026, not from the official draft text. According to these summaries, draft Article 23 adds an express requirement for controllers to store personal data within the Kingdom, while transfers or disclosures abroad remain permitted under the law and its regulations. Reed Smith notes the wording is ambiguous: it could mean keeping a local copy alongside lawful transfers, or simply making storage in the Kingdom the baseline.
The draft restructures the impact assessment triggers in Article 25 to cover data of minors and people lacking legal capacity, large-scale processing or processing involving regular or systematic monitoring, emerging technologies, and automated decisions affecting data subjects’ rights. It moves the data protection officer rules into the regulation with adjusted triggers, including large-scale regular or systematic monitoring and core activities involving sensitive data, and requires controllers to document the appointment and register the officer’s contact details on the SDAIA platform. It also moves the National Register of Controllers into Article 34, so registration would be required for public entities, controllers whose core activity is processing personal data or who process sensitive data, and controllers transferring data outside the Kingdom.
What it means for the Saudi market
The draft does not mention surveillance cameras by name. Still, CCTV footage that shows identifiable people can fall within personal data, and sites running large camera networks could fall under large-scale regular or systematic monitoring if the text is adopted as drafted. That touches where recordings are stored, especially cloud services outside the Kingdom, who can access them, and how a leak is reported. The Law on the Use of Security Surveillance Cameras and its implementing regulation remain the reference for where cameras are installed and how long recordings are kept.
The comment period closed on 5 November 2026. The next step lies with SDAIA: reviewing the comments, then approving and publishing a final text. Until then the current Implementing Regulation remains in force and the draft creates no new obligations.
AZEIDK Expert Take
There is no need to change your system based on a draft. It does help to have a clear picture of it: where recordings are actually stored, on an on-site NVR or a cloud service, who can view and export them, and whether access is logged. These questions are useful whether or not the amendments are adopted, and the final legal call belongs to your organization’s legal adviser. Read our guide to CCTV law obligations in Saudi Arabia, size local storage with the CCTV storage calculator or our article on NVR storage and bandwidth calculation. The security and surveillance systems page shows what AZEIDK designs, supplies and installs.
Sources
- 40 projects put to public consultation on the Istitlaa platform (in Arabic), Umm Al-Qura (official gazette), 8 October 2026
- The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL, Clyde & Co, 8 October 2026
- SDAIA Consults on Extensive Amendments to the Saudi PDPL Implementing Regulation, Reed Smith, 16 October 2026
- SDAIA opens public consultation on proposed amendments to the PDPL Implementing Regulation, Al Tamimi & Company, 9 October 2026
