SDAIA opens controller registration for overseas organisations: What multinationals need to do now

Saudi Arabia’s data protection landscape continues to evolve. SDAIA has now opened its controller registration framework to overseas organisations, removing a key barrier for multinational businesses and reinforcing the extraterritorial reach of the Kingdom’s Personal Data Protection Law (PDPL). This article outlines what has changed, who may be affected, and the steps organisations should consider taking now.

What has changed?

The Saudi Data & AI Authority (SDAIA) has launched a new registration service enabling organizations located outside Saudi Arabia to register in SDAIA's unified national register of controllers.

Under the Personal Data Protection Law (PDPL), certain controllers are required to register with SDAIA, including public entities, organizations whose core activities involve processing personal data, and organizations that process sensitive personal data. Until now, the registration process was only available to organizations holding a Saudi commercial registration, creating uncertainty for overseas businesses that fall within the scope of the PDPL but do not have an established presence in the Kingdom.

The launch of this new service removes that barrier by providing a dedicated registration pathway for foreign organizations. As a result, overseas businesses that process personal data relating to individuals in Saudi Arabia can now formally register with SDAIA even where they do not hold a Saudi commercial registration.

This is a significant development in the continued implementation and enforcement of the PDPL and provides greater clarity on how SDAIA expects overseas organizations to demonstrate compliance with their regulatory obligations.

Why is this development important?

This development is important because it increases SDAIA's ability to oversee and regulate organizations located outside the Kingdom.

From a practical perspective, registration is not only a standalone compliance obligation under the PDPL. Certain SDAIA services and regulatory interactions are in practice only available to registered organizations. This includes notifications of Data Protection Officer appointments and the submission of personal data breach notifications (which are subject to strict statutory deadlines under the PDPL).

Organizations that are required to register but have not done so may therefore face a dual compliance risk:
•    exposure to regulatory penalties of up to SAR 5 million for breaches of the PDPL; and
•    delays in accessing SDAIA's platform and regulatory services at critical times; including during a personal data breach investigation or notification process.

Perhaps most importantly, overseas organizations can no longer rely on the absence of a Saudi commercial registration as a practical obstacle to registration. SDAIA has now established a clear mechanism for foreign organizations to register and engage directly with the Kingdom's data protection regulator.

Key registration requirements

To register, an entity must:
•    Hold a valid commercial registration. 
•    Appoint an authorised representative.
•    Obtain verification and digital identity issuance through the Ministry of Foreign Affairs (MOFA) process applicable to non-Saudi companies.

What should organisations do now?

Businesses outside Saudi Arabia that collect, store, transfer or otherwise process personal data relating to individuals in the Kingdom should review their data processing activities and assess whether registration is required under the PDPL framework. Early assessment can help minimise compliance risks and ensure readiness. 

If you would like to discuss whether your organisation falls within the scope of these requirements or require assistance with the registration process, we would be pleased to arrange a discussion or answer any questions you may have.