AI Engineering · 6 MIN
Saudi PDPL and AI projects: data transfers, residency and what to ask a vendor
How the Saudi Personal Data Protection Law and SDAIA's transfer regulation affect AI projects: scope, sensitive data, cross-border calls to model APIs and vendor questions.
The Saudi Personal Data Protection Law applies to processing of personal data of people in the Kingdom, including by companies outside it, so an AI project that sends Saudi customer data to a model API abroad is a cross-border transfer question. Decide what data the model sees, where it is processed and which transfer safeguard applies before you build.
- SDAIA's official guide says the PDPL covers processing of personal data of individuals residing in the Kingdom by any party outside it.
- The guide also says small and medium businesses are in scope and that a controller must make sure its processors comply.
- Sending prompts that contain personal data to a model hosted abroad is a transfer, so it needs a basis under the transfer regulation.
- Health, genetic and biometric data used for identification are sensitive data under the law, with stricter rules, including a ban on processing sensitive data for marketing.
- The cleanest AI design keeps personal data out of the prompt through masking, retrieval and access controls.
- Nactore is an AI-native technology and growth company in Mumbai that designs AI systems with data minimization, evals and written data terms.
Does the Saudi PDPL apply to an AI project run from abroad?
Yes, in many cases. SDAIA, the Competent Authority, publishes a guide to the law for controllers and processors. It explains that Article 2 applies the law to processing of personal data related to individuals that takes place in the Kingdom by any means, including processing of the data of individuals residing there by any party outside the Kingdom. See the SDAIA guide.
The guide gives two examples that matter for AI buyers. A consulting firm in Germany serving clients in the Jeddah region is in scope when it processes their employees' data. And an online store in the Kingdom that stores customer data on a cloud service hosted in the United States is still regulated by the law.
What is personal data when you use an LLM?
The guide defines personal data broadly. It covers any data that can identify a person directly or indirectly, including names, contact details, bank and card numbers, photos and videos. It also says opinions and inferences attached to a person can count, and that pseudonymized data is still personal data.
For an AI system that means a prompt containing a customer name, a phone number, an invoice or a support transcript is personal data. So are embeddings of that text if they can be linked back to a person.
What counts as sensitive data in AI use cases?
The law lists categories that need extra care. They include data revealing ethnic origin, religious or political beliefs, criminal records, biometric data used for identification, genetic data, health data and data revealing unknown parentage. The guide notes that you cannot use legitimate interest as a basis for sensitive data, consent must be explicit, and sensitive data may not be processed for marketing even with consent.
Health inference is easy to trigger by accident. The guide's pharmacy example says inferences about health made from purchase history are sensitive data. A recommendation model can cross that line without anyone intending it.
How do cross-border transfers work for AI APIs?
SDAIA issued a Regulation on Personal Data Transfer outside the Kingdom, which lists safeguards such as standard contractual clauses and binding common rules, and it publishes its standard contractual clauses. Ask counsel which route fits your case and whether any list of countries recognized as adequate has been published by the time you build.
For an AI team, this turns into design choices.
| Design choice | Transfer exposure | When it fits |
|---|---|---|
| Mask or remove personal data before the API call | Low, nothing personal leaves | Classification, summarization, drafting |
| Send personal data to a model hosted abroad | Transfer, needs a lawful basis and safeguards | Only where counsel signs off |
| Use a model hosted in the Kingdom | Lower exposure, check the provider's terms | Sensitive or regulated workflows |
| Run an open model in your own cloud region | You control location and logs | High volume or strict data rules |
SDAIA's own Arabic model, ALLaM, has a 7-billion-parameter version listed on Hugging Face, which gives Saudi buyers a local option to evaluate. As always, test it against alternatives on your data.
What should you ask an AI vendor about Saudi data?
- Which provider sees the data? Get names, regions and retention terms for every model and cloud service.
- What do you log? Prompts and answers can contain personal data, so ask for masking and short retention.
- What is the transfer basis? The vendor should name the safeguard and attach it to the contract.
- How are deletion and access requests handled? Individuals have rights under the law, so your system needs a way to find and remove their data.
- Who is the processor? The guide says controllers must ensure their processors comply, so insist on written processor terms.
- What happens at the end? Data returned or deleted, with confirmation.
For contract language, read IP and data terms for AI projects and security questionnaire for tech vendors.
Does Saudi law require data to stay in the Kingdom?
The PDPL does not set a single blanket localization rule for all personal data. It sets conditions for transfers. Sector rules and contracts may add their own hosting terms, so confirm your sector's rules with a Saudi lawyer before you pick a cloud region.
Design the first version so personal data never reaches the model. Mask names, phone numbers and IDs, pass a reference ID, and look up the real value after the model responds.
Frequently asked questions
Is pseudonymized data outside the PDPL?
No. SDAIA's guide says pseudonymized data is still personal data. Only data that cannot identify a person is outside the law.
When did the PDPL start to apply?
It came into force on 14 September 2023. The guide says organizations had a one-year grace period and were expected to comply by 14 September 2024.
Can we use a public model API for Saudi customer chats?
Only after you decide what the model sees and which transfer safeguard applies. Masking personal data first is the lowest-risk approach.
Is this legal advice?
No. Confirm with qualified Saudi counsel.
Treat the prompt as a data flow
Draw the path of every field from user to model to log, and the law becomes an engineering checklist. Nactore builds, ships, ranks and grows as one partner, and builds AI with the data path written down.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.