Draft Amendments to the PDPL Implementing Regulations
On October 6, 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation on draft amendments to the Implementing Regulations of the Personal Data Protection Law (PDPL). The consultation will run until November 5, 2026. If adopted, the Implementing Regulations amendments would continue SDAIA’s efforts to mature the Kingdom’s data protection framework and provide greater clarity on practical compliance obligations.
Key developments include data localisation requirements, stricter rules for reporting personal data breaches, revised DPO obligations, the obligation to respond to regulator requests within 20 business days of receipt, and several others.
Particular attention should be paid to the amendment to Article 24 concerning breach notifications. Under the current rules, a controller must notify SDAIA within 72 hours only where the breach is likely to cause harm to personal data, affect data subjects, or conflict with their rights or interests. The proposed wording removes this threshold: SDAIA must be notified within 72 hours of discovering a breach, damage or unauthorised access - regardless of whether harm is likely to result.
In these circumstances, the 72-hour deadline becomes particularly strict, and the speed of response takes centre stage. This is where SearchInform Next-Gen DLP Risk Monitor comes to the rescue. The system records events in real time and retains a complete archive of user actions and traffic, enabling the security team to conduct a retrospective analysis and quickly reconstruct the chain of events.
E-Forensics preserves original messages, attachments and conversations, enabling a precise investigation instead of reconstructing the picture from scattered fragments. The built-in AI Cybersecurity Assistant analyses the full context of email threads and chats, detecting complex incidents whose signals are spread across a lengthy correspondence, and promptly generates a summary and translation of the key dialogue for the security team.
Together, these capabilities help the security team quickly establish the scale of an incident, the data affected and the people responsible - and therefore prepare materials for reporting to SDAIA faster.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
