What are the 2026 Saudi PDPL draft amendments?

Draft amendments to the PDPL Implementing Regulation, which SDAIA opened for public comment on the Istitlaa platform on 6 October 2026. The draft is not in force, and the current Implementing Regulation still applies. Clyde & Co's summary says the draft would require controllers to keep evidence of consent.

Keeping that evidence is already expected. The current Implementing Regulation wants consent documented in a way that allows later verification, with the time and the means (Article 11), so a website that records each visitor's choice today is not waiting on the draft.

Until the amended text is adopted, read the law as SDAIA publishes it now: the Personal Data Protection Law as amended by Royal Decree M/148 in March 2023, its Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom.