How to comment on SDAIA's draft PDPL amendments before 5 November 2026
SDAIA's public consultation on amendments to the Implementing Regulation of the Personal Data Protection Law opened on 6 October 2026 and closes on 5 November 2026. Comments go through Istitlaa (istitlaa.ncc.gov.sa), the Saudi government's public consultation platform. This guide covers who can comment, what makes a comment useful, and the consent and marketing provisions a business website is best placed to comment on.
How to comment, in short
- Open the SDAIA consultation on Istitlaa (istitlaa.ncc.gov.sa) and read the draft text on the consultation page.
- Sign in: submitting a comment on Istitlaa requires an account.
- Choose the articles you want to comment on. You do not need to cover the whole draft.
- For each article, give its number, what it would mean in practice, your evidence, and the wording you propose.
- Submit on the consultation page before 5 November 2026.
We describe the platform only as far as public sources do; follow the instructions on the consultation page itself. The draft is not in force; the current Implementing Regulation still applies, and SDAIA will review the comments before deciding on the final text.
Who can comment
SDAIA invited the public and organisations to comment, so businesses, agencies, associations and individuals can all respond. You do not need to be a lawyer. Operators of websites and online stores are well placed: the consent and marketing provisions describe what they would have to do on their own sites every day.
What makes a comment useful
- Cite the article: name the article number and quote the words you are commenting on.
- Say what it means in practice: describe how the rule would work on a real website or in a real marketing process.
- Bring evidence: numbers, examples or your own experience carry more weight than opinion.
- Propose wording: suggest the text you would like to see, not only the problem.
- Keep each point short: one point per article is easier to review than a long letter.
The consent and marketing provisions worth commenting on
For a business website, two parts of the draft touch daily practice most: proof of marketing consent, and what happens when someone withdraws it.
| Provision | What the draft proposes | Evidence from Saudi websites (September 2026) |
|---|---|---|
| Articles 28 and 29: consent for marketing | Controllers would have to verify and keep evidence that valid consent exists for marketing, even where they rely on an earlier relationship with the customer. | 935 (60%) of 1,556 online stores track visitors with no consent banner at all, so there is no consent to evidence. |
| Article 29(2): withdrawal | When someone withdraws consent, the controller would stop the marketing, stop the underlying processing and delete the personal data it generated. | 1,065 (68%) load trackers before the visitor makes any choice, so processing starts before there is anything to withdraw. |
We call the first row tracking without asking: trackers running on a site that shows no consent banner at all. Figures like these help a comment show the starting point the rules would land on.
What the draft changes for a business website, in more detail: SDAIA's draft PDPL amendments: what changes for business websites.
To bring evidence from your own site, see which trackers load before consent on your homepage: scan your site for free.
A free 60-second scan of any e-commerce site in a real browser. No signup.
Scan my store freeOur own comment
We are filing a comment on the consent and marketing provisions only, based on our open data on Saudi online stores, and will publish it here before 5 November 2026.
Sources and method
The consultation dates and the invitation to comment come from the Saudi Press Agency notice. The summary of the draft is based on the analyses published by Clyde & Co (8 October 2026), Bird & Bird (8 October 2026) and Al Tamimi & Company (9 October 2026). The website figures come from our KSA E-Commerce Privacy Compliance Index: each store's homepage was loaded once in a real browser, without touching any banner, and the data was aggregated on 7 September 2026. These are measurements of what websites do, not legal findings about any company, and this page is not legal advice.
On Istitlaa (istitlaa.ncc.gov.sa), the Saudi government's public consultation platform, on the SDAIA consultation page. Submitting requires an account. Comments are open until 5 November 2026.
Yes. SDAIA invited the public and organisations to comment, so businesses, agencies and individuals can respond. A useful comment cites the article number, explains what it means in practice, gives evidence and proposes wording.
Proof of marketing consent under Articles 28 and 29, and Article 29(2) on withdrawal: when someone withdraws consent, the controller would stop the marketing and the underlying processing and delete the personal data it generated.
Sources
SDAIA invites comments on proposed amendments to the PDPL Implementing Regulation The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL Saudi Arabia: SDAIA returns with a revised draft of changes to the Data Protection Regulations SDAIA Opens Public Consultation on Proposed Amendments to the PDPL Implementing Regulation KSA E-Commerce Privacy Compliance Index, September 2026 (Zenodo, CC BY 4.0)Ready for MENA compliance?
Arqam360 handles GDPR, Saudi PDPL, and UAE PDPA from a single platform — with Arabic RTL support built in.
Start Free TrialRelated Articles
Stay updated
Get privacy compliance tips and Arqam360 updates delivered to your inbox.