KSA PDPL: Sector Mapping and SDAIA Registration Requirements

A common misconception is that every company processing personal data in Saudi Arabia must register with the Saudi Data & AI Authority (SDAIA). That is not the case. The Personal Data Protection Law (PDPL) has a broad scope, while mandatory registration in SDAIA's National Register of Controllers is based on specific criteria. Understanding this difference is critical for companies in healthcare, banking, insurance, real estate, construction, technology, retail, and hospitality.

SDAIA is the competent authority overseeing PDPL implementation and maintaining the National Register of Controllers. The Law applies to any organization acting as a Controller or Processor within its scope. A Controller determines the purposes and manner of processing personal data; a Processor acts on behalf of a Controller. Both roles are subject to the PDPL, though obligations differ.

PDPL Scope and Sector Priorities

Personal data is defined broadly, including names, contact details, national ID numbers, financial and bank information, photographs, video, personal assets, employment information, location data, and any other information that can directly or indirectly identify an individual. This means PDPL compliance is not restricted to data-centric businesses. A construction company processing employee and contractor information, a real estate firm maintaining buyer and tenant records, or a hotel collecting guest data can all fall within scope.

What Makes a Sector High-Priority

Although the PDPL is not organized around a list of sectors, practical compliance risk varies considerably. High-priority sectors typically process large volumes of personal data, handle Sensitive Data, use biometric identification, make decisions that significantly affect individuals, share data extensively with third parties, transfer data outside Saudi Arabia, or operate complex digital platforms. Healthcare is therefore a higher-priority sector than a small trading company, even though both may be subject to the Law.

Healthcare, Banking, and Insurance

Healthcare organizations are among the most significant compliance candidates because they routinely process health information, identification data, and potentially genetic or biometric information. Hospitals, clinics, laboratories, pharmacies, medical platforms, and health-tech companies should treat PDPL compliance as a high priority. Banking, financial services, insurance, and fintech organizations also process extensive customer information, including financial and identification data, and may face sector-specific regulatory requirements. However, being a bank or insurer does not, by itself, create the SDAIA registration obligation—actual processing activities must be assessed against the registration rules.

SDAIA Registration Triggers and Sensitive Data

The Rules Governing the National Register of Controllers provide the key answer. A Controller subject to the PDPL must register on the National Data Governance Platform when any of the specified conditions applies. These include being a public entity, having a main activity based on personal-data processing, processing Sensitive Data, or processing personal data beyond personal or family use. SDAIA registration is a processing-based obligation, not a sector-based one.

Main-Activity Processing and Tech Companies

Companies whose core business involves personal-data processing require particular attention. This includes data analytics companies, credit information businesses, data platforms, identity verification providers, AI and data-driven companies, recruitment and background-screening firms, customer-data platforms, and other businesses whose main activity is personal-data processing. The National Register rules specifically identify this as a mandatory registration trigger. A software company that merely maintains employee and customer records is not automatically required to register simply because it is an IT company. Conversely, a company whose principal business involves processing personal data may fall directly within the registration requirement.

Sensitive Data and Biometric Processing

Sensitive Data includes information relating to health, genetic characteristics, biometric characteristics used for identification, criminal or security-related information, and certain information concerning origin, beliefs, and parentage. Processing Sensitive Data can trigger mandatory registration. SDAIA's guidance also notes that legitimate interest cannot be relied upon as a legal basis for processing Sensitive Data, and explicit consent requirements may apply. For example, a property management company using biometric identification for building access should examine whether that processing creates a registration obligation. Similarly, a construction company using biometric systems for workforce identification should assess the nature of that processing rather than assuming its industry classification determines the answer.

Sector-by-Sector Application

Several sectors fall into a middle category: they clearly process personal data, but sector membership alone does not automatically determine registration. Telecoms process subscriber, identity, usage, and location data. Universities process student, parent, and employee information, and may handle health or biometric data. Real estate developers, brokers, and property managers process buyer, seller, tenant, and landlord information, including identification, contact, contractual, property, and financial data. Construction and engineering companies process employee, contractor, visitor, and access-control information. All these organizations should consider PDPL compliance, but registration depends on whether a specific condition applies.

Retail, Hospitality, and Other Businesses

The same principle applies to retail, e-commerce, hospitality, tourism, car rental, equipment rental, leasing, manufacturing, professional services, and general trading. A retailer may process customer names, addresses, purchase history, and payment information. A hotel may process guest identification, booking, contact, and payment data. A car rental company may process identification documents, driving licence information, and rental records. A manufacturer may process employee, contractor, and visitor information. These organizations can all be subject to the PDPL, even though ordinary personal-data processing does not automatically mean SDAIA registration is mandatory.

PDPL Compliance vs. SDAIA Registration

This is perhaps the most important distinction. PDPL applicability is broad; SDAIA registration is narrower. A small trading company may maintain employee, customer, and supplier information and should consider its PDPL obligations, but ordinary processing does not automatically place it within the mandatory registration criteria. On the other hand, a healthcare organization processing patient health data may fall within the registration requirement because it processes Sensitive Data. Similarly, a data analytics company whose main business is processing personal data may be required to register. SDAIA's registration process for private entities requires an active commercial registration and an authorized representative, followed by registration through the National Data Governance Platform, which includes an assessment relating to the need to appoint a Personal Data Protection Officer.

What we recommend

Organizations should avoid starting their PDPL program by asking only whether they need to register with SDAIA. Instead, conduct a broader applicability and compliance assessment. Establish what personal data you collect, who the Data Subjects are, why the data is processed, whether Sensitive Data is involved, whether you act as Controller, Processor, or both, whether personal-data processing is a main activity, whether data is shared with third parties or transferred outside Saudi Arabia, applicable retention requirements, and whether a Data Protection Officer is required. Maintain records of processing activities as required by the Implementing Regulations, covering purposes, categories of data and Data Subjects, retention periods, recipients, international transfers, and security measures.

KSA PDPL compliance is not simply a matter of completing an SDAIA registration form. Axpert Cyber helps organizations assess their obligations and build a practical compliance roadmap tailored to their business and sector. If you operate in Saudi Arabia and are unsure whether PDPL compliance or SDAIA registration applies to you, we can help you determine your regulatory position and establish a path toward compliance.