SDAIA (Saudi Data and AI Authority)

The Saudi Data and Artificial Intelligence Authority (SDAIA) is the Kingdom's central authority for the national data and artificial intelligence agenda. Established in 2019, it sets national strategy and policy for data and AI, operates national data platforms, and oversees the bodies that execute the agenda — including the National Data Management Office (NDMO), which regulates data management and personal data protection practices.

SDAIA is also the enforcement authority for the Personal Data Protection Law (PDPL). It issued the law's implementing regulations, the rules governing transfers of personal data outside the Kingdom, and the guidance organizations rely on to interpret their obligations. It is the body to which data breaches are reported, and violations pursued before it carry penalties of up to SAR 5 million, rising to SAR 10 million for repeat offenses.

For a Saudi Data Management Office, SDAIA defines the regulatory landscape almost entirely: the PDPL and its regulations, the NDMO framework of 15 domains, 77 controls, and 191 specifications, and national data classification policy all trace back to it. Treating SDAIA's publications as the canonical reference — and structuring the data catalog, classification scheme, and compliance reporting around them — keeps a data program aligned with where Saudi regulation is going, rather than reacting to each new requirement after the fact.