As of 2025, the Saudi Data and Artificial Intelligence Authority (SDAIA) has introduced significant updates to advance the Kingdom’s data governance, artificial intelligence (AI) infrastructure, and digital economy, aligning with Vision 2030 objectives.
Strengthening Data Protection and Regulatory Frameworks
Following the enforcement of the Personal Data Protection Law (PDPL) in September 2024, SDAIA has implemented several measures to ensure robust data governance:
- Licensing Framework: In January 2025, SDAIA concluded consultations on a proposed regulatory framework to introduce licenses for activities involving personal data processing, auditing, and certification issuance.
- Cross-Border Data Transfer Regulations: SDAIA amended the Data Transfer Regulations to align with international standards, requiring organizations to implement safeguards like standard contractual clauses (SCCs) or binding corporate rules (BCRs) when transferring personal data to countries without adequate data protection levels.
- Risk Assessment Guidelines: In February 2025, SDAIA published the “Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom,” providing a framework for entities to assess risks associated with disclosing personal data to foreign entities.
- Data Protection Officer (DPO) Rules: SDAIA issued rules outlining the minimum requirements for appointing a DPO, including criteria, responsibilities, and circumstances when a DPO is required.
- National Registration of Controllers: Rules were established requiring certain Saudi entities to register with SDAIA, including public entities and controllers processing sensitive personal data that poses a high risk to data subjects’ rights.
Advancing AI Infrastructure and Applications
SDAIA has made significant strides in enhancing AI infrastructure and applications:
- Generative AI Guidelines: SDAIA issued guidelines for adopting and using generative AI systems, addressing both government employees and the public. These guidelines highlight challenges and considerations for the use of generative AI, introduce principles for responsible use, and present best practices.
- AI Ethics Principles 2.0: SDAIA published the second iteration of its AI Ethics Principles, establishing a principle-based ethical framework for the development and use of AI technologies in Saudi Arabia. The framework is based on seven principles, including Fairness, Privacy & Security, and Accountability & Responsibility.
- Collaboration with IBM: In September 2024, SDAIA partnered with IBM to introduce IBM’s enterprise studio, watsonx.ai, and SDAIA’s open-source Arabic Large Language Model (LLM) — ‘ALLaM’ — to the Kingdom’s DEEM Cloud platform. This collaboration aims to enhance the offering of DEEM’s cloud technologies and empower Saudi government entities in their AI transformation journey.
Commitment to Vision 2030 and Global Leadership
SDAIA continues to drive initiatives that position Saudi Arabia as a global leader in data and AI:
- International Recognition: In 2024, the Kingdom, represented by SDAIA, achieved first place globally in several areas, including the Government Strategy for AI Pillar and the Open Government Data Index (OGDI). Regionally, it ranked first in the E-Government Development Index (EGDI).
- Public Awareness and Education: SDAIA’s efforts have led to increased public awareness of AI, with 75% of the public in the Kingdom aware of the concept of artificial intelligence, and 64% knowing the cases of using AI and its applications.
- Infrastructure Development: The Kingdom has become the second-largest country in the Middle East in terms of the number of shared data centers, with 22 active centers and 40 under development as of 2023.
