Saudi PDPL and AI: what an AI chatbot or HR tool must have on paper (2026)

Saudi PDPL has been enforceable since 14 September 2024. Here is what changes when your AI processes personal data in the Kingdom, with official SDAIA sources.

Updated 13 Oct 2026. General information, not legal advice.

Is the Saudi PDPL already enforced?

Yes. The PDPL came into force on 14 September 2023 with a one-year grace period, so it has been enforceable since 14 September 2024. SDAIA is the competent authority (SDAIA Guide to the PDPL).

Does it apply to AI chatbots, voice agents and AI recruitment tools?

Yes, whenever they process personal data of people in the Kingdom: names, phone numbers, call recordings, CVs. The PDPL is technology-neutral, so the usual duties apply: lawful basis, notice, data-subject rights, security and transfer rules.

What do the SDAIA AI Ethics Principles add?

They ask entities that build or use AI to govern it across its lifecycle: privacy and security, fairness, transparency, accountability and human oversight. SDAIA can monitor compliance with the framework.

What is the first document to prepare?

An inventory of your AI systems: what each does, which personal data it uses, its purpose and legal basis, where data is hosted, and who reviews its decisions.

Get a free 1-page AI-system inventory draft for one of your AI tools

Official and cited sources

Team Unadhi

More Unadhi Gulf guides · EURO AI Register (free for 1 system) · Paid membership checkout: EURO AI Register on Gumroad