Compliance

Controller / Processor

GDPR roles applicable to AI providers and deployers.

How the laws define this

Every framework establishes the same core distinction: a controller determines the purposes and means of processing personal data, while a processor acts or performs processing tasks on behalf of that controller. The instruments diverge, however, in their targeted applications and specific regulatory mandates. The Data Protection Commission Guidance on AI and Large Language Models applies these GDPR concepts specifically to AI providers, deployers, and third-party suppliers based on decision-making and purposes. Conversely, the Royal Order establishing the Saudi Data and Artificial Intelligence Authority (SDAIA) subjects controllers and processors under the Personal Data Protection Law (PDPL) to SDAIA national data governance policies, requiring registration with a national register and compliance tools where applicable. Distinct from both, the National Data Governance Interim Regulations uniquely frame these as designated public-entity roles with delineated responsibilities for compliance, data sharing, freedom of information, open data, and safeguards.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Saudi Arabia	Royal Order No. (A/471) establishing the Saudi Data and Artificial Intelligence Authority	In Force	Adds requirements for controllers and processors to register with SDAIA's national register and use its compliance tools, in addition to PDPL obligations.
Ireland	Data Protection Commission Guidance on AI and Large Language Models	In Force	Applies GDPR roles specifically to AI providers, deployers, and third-party suppliers based on decision-making and purposes in AI contexts, as non-binding guidance.
Saudi Arabia	National Data Governance Interim Regulations (including Open Data, Data Sharing, Freedom of Information and Personal Data Interim Regulations)	In Force	Limits roles to designated public entities with delineated responsibilities for compliance and safeguards under interim data governance rules.

What it triggers

In Saudi Arabia, controllers and processors are subject to PDPL obligations and, where applicable, registration with SDAIA's national register and compliance tools.source
Under the National Data Governance Interim Regulations, controllers and processors have delineated responsibilities for compliance and safeguards.
The Data Protection Commission Guidance on AI and Large Language Models sets out how GDPR controller and processor roles apply to AI providers, deployers and third-party suppliers.source

Definitions (3)

The GDPR roles that determine legal responsibilities in AI contexts: a controller decides purposes and means of processing, while a processor acts on behalf of a controller; the guidance explains how these roles apply to AI providers, deployers and third‑party suppliers depending on decision‑making and purposes.

Data Protection Commission Guidance on AI and Large Language ModelsDefinition 1 of 3

As defined under the Personal Data Protection Law (PDPL) and SDAIA national data governance policies, controllers and processors are entities that determine the purposes and means of processing personal data (controllers) or process personal data on behalf of controllers (processors); they are subject to PDPL obligations and, where applicable, registration with SDAIA's national register and compliance tools.

Royal Order establishing the Saudi Data and Artificial Intelligence Authority (SDAIA) (establishment of a national authority for data and AI)Definition 2 of 3

Designated public-entity roles where a Controller determines the purposes and means of processing personal data and a Processor acts on behalf of the Controller to perform processing tasks, with delineated responsibilities for compliance and safeguards.

National Data Governance Interim Regulations (including Open Data, Data Sharing, Freedom of Information and Personal Data Interim Regulations)Definition 3 of 3

Not to be confused with

Controller

Controller is the single role determining purposes and means, while this term covers both controller and processor roles together.

Processor

Processor is the single role processing on behalf of controllers, while this term covers both controller and processor roles together.

Provider/Operator

Provider/operator refers to actors providing or deploying AI systems, while this term focuses on data processing roles under data protection laws.

Questions and answers

What obligations apply to controllers and processors in Saudi Arabia?

Controllers and processors must comply with PDPL obligations. Where applicable, they must register with SDAIA's national register and use its compliance tools.

How do controller and processor roles apply to AI in Ireland?

The guidance explains how GDPR roles apply to AI providers, deployers and third-party suppliers depending on decision-making and purposes. It is non-binding.

What are the responsibilities for data roles in Saudi public data governance?

Controllers determine purposes and means of processing personal data. Processors act on behalf of controllers with delineated responsibilities for compliance and safeguards.