My company works in Saudi Arabia. What does the law ask of us when an AI agent reads our data?
The short answer
The Personal Data Protection Law applies, and it has been enforceable since September 2024. Consent is the default basis for processing personal data. If the model that serves your agent runs outside the Kingdom, every request that carries personal data is a transfer abroad, and that is allowed only under the conditions of the transfer regulation. SDAIA's AI ethics principles and generative AI guidelines are not laws.
The law that applies
The Personal Data Protection Law was issued by Royal Decree M/19 of 1443H and amended by Royal Decree M/148 of 1444H. It came into force on 14 September 2023, and companies were expected to comply by 14 September 2024. The Saudi Data and AI Authority, SDAIA, is the authority that enforces it.
The law covers personal data of people living in the Kingdom, including processing done from outside the Kingdom. The only exception is personal or family use, and the implementing regulation says that business use never counts as personal use. So a foreign model provider that processes your clients’ data is within its reach.
Can the agent read personal data at all?
Yes, if you have a legal basis. The default basis is the person’s consent, and consent can be withdrawn at any time. The law also allows processing without consent in a few cases:
- Another law requires it, or a prior agreement the person is party to, such as an employment contract or a client contract.
- Your legitimate interest. This basis cannot be used for sensitive data. The processing must stay within what the person would reasonably expect, and you must document an assessment that weighs your interest against the person’s rights before you start.
Three rules matter most for an agent:
- One consent per purpose. Consent given for invoicing does not cover an agent that reads the same records for another purpose.
- Explicit consent for decisions made only by machine. The implementing regulation requires explicit consent where a decision is made solely by automated processing. If the agent decides something about a person without a human in between, this rule applies.
- The minimum necessary. Process only the data the purpose needs. An agent that can read every field of every record breaks this rule before it does anything wrong.
The model provider is your processor
When the agent sends text to a model run by a provider, the provider processes that data on your behalf. The law allows you to use only processors that give the necessary guarantees. Your contract with the provider must state, among other things, whether the provider is subject to the laws of other countries, and it must name the sub-processors. A sub-processor needs your prior acceptance.
Sending data outside the Kingdom
The law allows a transfer abroad for a set of purposes, and normally only if three conditions hold. It must not harm national security or the Kingdom’s vital interests. The destination must offer protection at least equivalent to Saudi law. And only the minimum data needed may be sent. The transfer regulation exempts some cases from the second and third conditions, but those cases still need safeguards.
The transfer regulation, version 2.0 of August 2024, sets out how this works:
- Adequate countries. SDAIA will publish a list of countries whose protection it considers adequate.
- Safeguards where there is no adequacy. You may transfer under SDAIA’s standard contractual clauses, under binding common rules within a group of companies, or under an accreditation certificate. The standard clauses come as 4 fixed templates. You may not change their wording, and you give a copy to SDAIA when it asks.
- A risk assessment first. Before a transfer that relies on these safeguards, and before any continuous or large-scale transfer of sensitive data, you must assess the risk. SDAIA published a guideline for this in February 2025, with an optional assessment tool.
Before you start, and when something goes wrong
- Impact assessment. The implementing regulation requires a written impact assessment where your activity includes, on a large scale and repeatedly, processing based on newly adopted technologies or decisions based on automated processing. It also requires one for any processing of sensitive data. An AI agent that runs across your business will usually fall within this.
- Breach notification. You must notify SDAIA within 72 hours of becoming aware of a breach that may cause harm. You must tell the affected people without undue delay, in simple language.
- Registration and a data protection officer. Registration on SDAIA’s National Data Governance Platform is required if your main activity is based on processing personal data, or if you process sensitive data. A data protection officer is required in some cases, for example where your core activities rest on sensitive data.
The penalties are real. A breach of the law can bring a warning or a fine of up to 5 million riyals, doubled for a repeat offence. Disclosing sensitive data to harm someone or for personal gain can bring up to 2 years in prison.
What SDAIA says about AI itself
SDAIA has published AI Ethics Principles, version 1.0 of September 2023, with 7 principles that include privacy and security, transparency and explainability, and accountability. It has also published generative AI guidelines, in one version for government and one for the public. These are not laws, but the AI Ethics Principles state that they apply to everyone who builds or uses AI in the Kingdom. The generative AI guidelines are guidance. I found no Saudi law that regulates AI as such, as of October 2026. For an agent that handles personal data, the binding rules are the data protection law and its regulations.
Sector rules
Banks and finance companies also answer to the Saudi Central Bank, whose powers the law preserves. Government entities and operators of critical national infrastructure must apply the National Cybersecurity Authority’s Essential Cybersecurity Controls, which now refer questions of data localization to the National Data Management Office.
What this means for you
- Write down, for each kind of data the agent reads, the legal basis you rely on.
- Limit the agent’s access to the fields its task needs.
- Find out where your model provider processes data, and if it is outside the Kingdom, choose the transfer route before you go live.
- Do the impact assessment before the agent touches personal data, not after.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- SDAIA, Personal Data Protection Law, National Data Governance Platform
- SDAIA, Implementing Regulation of the Personal Data Protection Law
- SDAIA, Guide to the Personal Data Protection Law for controllers and processors, December 2023
- SDAIA, Regulation on Personal Data Transfer outside the Kingdom, version 2.0, August 2024
- SDAIA, Standard Contractual Clauses for Personal Data Transfer, September 2024
- SDAIA, Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom, February 2025
- SDAIA, Rules for Registering on the National Data Governance Platform
- SDAIA, AI Ethics Principles, version 1.0, September 2023
- SDAIA, Regulations and Policies
- National Cybersecurity Authority, Essential Cybersecurity Controls