Do I need to register with SDAIA?

Only in four cases, set by SDAIA's Rules Governing the National Register of Controllers: you are a public entity, your main activity is based on processing personal data, you process sensitive data, or you are an individual processing personal data beyond personal or family use. Registration is on the National Data Governance Platform.

The register comes from the amended PDPL: Article 30 lets SDAIA keep a national register of controllers, and Article 34 of the Implementing Regulation tells it to issue the registration rules. These rules cover controllers inside the Kingdom; SDAIA says separate rules will be issued for controllers located outside it. A store that processes health data, for example, processes sensitive data and falls in the third case.

Once registration is complete, the platform issues a certificate valid for up to 5 years, and it carries breach notification within 72 hours, a privacy impact assessment tool and a compliance assessment. A store that does not have to register still owes everything else: consent before analytics and advertising tags run, answers to data requests within 30 days, and a record of processing.