Overview
The Rules Governing the National Register of Controllers Within the Kingdom establish the regulatory framework for registering Personal Data Controllers on the National Data Governance Platform under the Saudi Personal Data Protection Law (PDPL). Issued by the Competent Authority (SDAIA) pursuant to PDPL Article 30(4) and Implementing Regulation Article 34, these Rules define the scope, purpose, and oversight mechanisms for monitoring Controllers’ compliance with PDPL obligations within the Kingdom.
The Rules clarify which Controllers are required to register, the regulatory intent behind the National Register, and the role of the Competent Authority (SDAIA) in supervising and enforcing compliance through centralized registration and monitoring.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Introduction
Pursuant to Article (30), paragraph 4, of the Personal Data Protection Law Issued by Royal Decree No.) M/19 (dated 9/2/1443 AH, amended by Royal Decree No.) M/148 (dated 5/9/1444 AH, which provides: "The Competent Authority, in order to carry out its duties related to supervising the implementation of the provisions of the Law and Regulations, may:...(C) Specify the appropriate tools and mechanisms for monitoring Controllers’ compliance with the provisions of the Law and the Regulations, including maintaining a National Register of Controllers for this purpose". In accordance with Article (34) of the Implementing Regulation of the Law, which mandates that the Competent Authority shall issue the rules for registration in the National Register of Controllers, these Rules are hereby established. The purpose of these Rules is to inform and monitor Controllers within the Kingdom of the scope of their obligation to register on the National Data Governance Platform. Separate registration rules for Controllers located outside the Kingdom will be issued by the Competent Authority.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
