SDAIA's draft PDPL amendments: what changes for business websites (consultation open until 5 November 2026)

On 6 October 2026 the Saudi Data & AI Authority (SDAIA) opened a public consultation on amendments to the Implementing Regulation of the Personal Data Protection Law. It closes on 5 November 2026. For a business website, three proposals matter most: proof that marketing consent exists, a clear way to withdraw it, and a privacy policy written in the language your customers use.

What the draft changes for a business website

• Proof of consent for marketing: under the revised Articles 28 and 29, controllers would have to verify that valid consent exists, even where they rely on an earlier relationship with the customer, and keep evidence of it. Article 29 would cover any processing of personal data for marketing, not only sending marketing messages, which is wider than email and SMS campaigns.
• Easy withdrawal, then deletion: people must have clear, accessible ways to withdraw consent. When they do, the controller would have to stop the marketing, stop the underlying processing and destroy the personal data that processing generated, without undue delay.
• A privacy policy in your customers' language: a new Article 18 (Repeated) would require privacy policies in clear, simplified language, consistent with the language customarily used to provide the product or service. Clyde & Co reads this as likely to mean an Arabic privacy policy for most organisations.

The draft also covers other subjects, such as breach notification, data protection officers and controller registration. This page covers only consent, marketing and privacy policies. The draft is not in force; the current Implementing Regulation still applies, and SDAIA will review the comments before deciding on the final text.

Where Saudi websites stand today

Most Saudi online stores would start from zero on proof of consent: they track visitors without asking.

We call the first row tracking without asking: trackers running on a site that shows no consent banner at all. For these sites, the draft's evidence and withdrawal rules have nothing to work with: no consent was asked, so there is no record to show and nothing to withdraw.

Full Saudi data, method and charts: KSA E-Commerce Privacy Compliance Index.

What to check on your site this week

Five checks. None of them needs a lawyer or a new tool to start.

• Open your homepage in a private window: is there a consent banner, in Arabic and English, with a refuse option as clear as accept?
• With the banner untouched, open the browser's developer tools (Network tab) and reload: no requests to Google Analytics, Google Ads or Meta should appear before you answer.
• Find out where each visitor's choice is recorded, with the date and what was accepted. That record is the evidence the draft asks for.
• Check that a visitor can change their mind later from a link that is always visible (often in the footer), and that rejecting stops the ad tags.
• Open your privacy policy: is it linked from every page, is there an Arabic version, and is it written plainly enough for your customers to follow?

To see which trackers load before consent on your homepage: scan your site for free.

How to comment before 5 November

Comments go through Istitlaa, the Saudi government's public consultation platform, until 5 November 2026. Businesses, agencies and individuals can all respond. We are preparing our own comment on the consent and marketing provisions and will publish it, with a step-by-step guide to commenting, before the deadline.

What SDAIA has enforced so far: Saudi and UAE privacy enforcement tracker.

Sources and method

The summary of the draft is based on the analyses published by Clyde & Co (8 October 2026) and Al Tamimi & Company (9 October 2026); article numbers follow Clyde & Co. The website figures come from our KSA E-Commerce Privacy Compliance Index: each store's homepage was loaded once in a real browser, without touching any banner, and the data was aggregated on 7 September 2026. Homepage and client-side only, so the real rates are likely higher. These are measurements of what websites do, not legal findings about any company, and this page is not legal advice.

Sources