On 6 October 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) opened a public consultation on draft amendments to the Implementing Regulation of the Personal Data Protection Law (PDPL). According to Clyde & Co’s analysis, the consultation runs until 5 November 2026, and the changes would take effect 60 days after publication in the Official Gazette if adopted.
Most coverage reads this as a legal update. For marketing and analytics teams, it is also a tracking update. Several proposals touch the things you run every day: promotional consent, audiences built from customer data, where your analytics data is stored, and how fast you must report a leak.
This is still a draft, and the final text may change. But the direction is clear enough to start checking your setup now, while there is still time to comment.
What the draft proposes, in plain terms
We focused on the proposals that affect digital marketing and measurement. The summaries below come from Clyde & Co and Reed Smith, two law firms that reviewed the draft. Confirm each point against the official draft on SDAIA’s Istitlaa consultation platform before relying on it.
- Marketing consent: Reed Smith reports that the current rules imply consent is not needed where there is a “prior interaction” with the recipient, while the draft requires consent for promotional or awareness messages in all circumstances. Clyde & Co adds that controllers would have to keep evidence of consent and offer accessible ways to withdraw it.
- All marketing processing, not just messages: per Clyde & Co, draft Article 29 covers all processing of personal data for marketing. When consent is withdrawn, the controller must “stop the underlying processing and destroy personal data generated as a result of that processing without undue delay.”
- Data storage in the Kingdom: draft Article 23 would require controllers to store personal data inside Saudi Arabia, while still allowing transfers abroad under the law. Reed Smith notes the wording is ambiguous on whether a local copy is required.
- Breach notification: Clyde & Co reports that notification to SDAIA would be required “within 72 hours of awareness, regardless of whether harm is likely to result.”
- Impact assessments and officers: a data protection impact assessment (DPIA) would also be needed for large-scale or regular, systematic monitoring, and a data protection officer (DPO) would be mandatory for controllers whose primary activities involve regular and systematic large-scale monitoring.
- Registration and notices: registration in the National Register of Controllers would be mandatory for controllers that transfer or disclose personal data outside Saudi Arabia, and privacy policies must use “clear, simplified and comprehensible language”, which Clyde & Co says would likely mean Arabic for most organisations.
Why analytics and marketing teams should care
Almost every website and app sends data abroad. Google Analytics (GA), ad pixels, heatmap tools and customer data uploads usually process data outside the Kingdom. If the registration and storage proposals stay as drafted, that alone could bring many brands into scope.
The consent changes matter just as much. Many teams build remarketing and lookalike audiences from “existing customer” lists on the assumption that a past purchase is enough. Under the draft, that assumption gets weaker, and a withdrawal would have to flow through to every system that used the data.
The 72-hour breach rule is also relevant to tracking. A tag that quietly sends emails or phone numbers to a third party is a data leak. If the harm threshold is removed, you have less room to decide it “doesn’t count”.
Six checks to run this week
1. Map where Saudi user data actually goes
List every tag, pixel and software development kit (SDK) on your Saudi-facing sites and apps. For each one, note the vendor, what data it receives and where that data is processed and stored. In Google Tag Manager (GTM), export the container and review tags, triggers and custom code. Don’t rely on old documentation; check what fires today.
2. Audit your marketing consent records
- Can you show when and how each contact agreed to receive promotional messages?
- Which email, text message and WhatsApp lists rely on a past purchase or interaction instead of explicit opt-in?
- Is the unsubscribe or withdrawal option easy to find in every channel?
3. Test that withdrawal reaches every system
Pick a test contact and withdraw consent. Then follow it: does the customer relationship management (CRM) record update? Is the contact removed from ad platform audience uploads and email tools? Draft Article 29 talks about stopping the processing and destroying data generated from it, so a suppression flag in one tool may not be enough.
4. Scan your analytics for personal data leaks
Look for personally identifiable information (PII) in page addresses, event parameters and form tracking. Common culprits are emails in query strings, phone numbers in search terms and names in custom dimensions. Fix these at the source, and consider server-side tagging so you can strip personal data before it reaches vendors.
5. Review your privacy notice and consent banner
Is your privacy policy available in clear Arabic as well as English? Does your consent management platform (CMP) actually block non-essential tags until the user agrees? Test it in a clean browser and watch the network requests.
6. Decide whether to comment before 5 November
If the storage or marketing consent proposals would seriously affect your business, share specific, practical feedback through the consultation. Bring your legal, technology and marketing teams together this week so the comment reflects how your measurement really works. This article is not legal advice; involve your counsel on what applies to you.
Final thoughts
The draft is not law yet, and some points may change. But the work it points to is useful either way: knowing where your data goes, proving consent, making withdrawals stick and keeping personal data out of your tags. Teams that do this now will spend less time scrambling when the final text lands, and will have cleaner data to show for it.
Sources
- Clyde & Co – The SDAIA publishes draft amendments to the Implementing Regulations of the PDPL (8 October 2026)
- Reed Smith – SDAIA Consults on Extensive Amendments to the Saudi PDPL Implementing Regulation (16 October 2026)
How Gmetrics can help
Gmetrics helps teams map their tracking, test consent and withdrawal flows, and remove personal data from analytics before it leaves your control. Our Data Privacy & Governance service covers exactly these checks. Contact us to talk through your setup.
