Saudi Arabia - National AI Authority (2019)

Overview

The Saudi Data and Artificial Intelligence Authority (SDAIA) was established by Royal Order in 2019 as the Kingdom’s central authority for data and artificial intelligence. SDAIA was created to deliver the national strategy for data and artificial intelligence, operate national data infrastructure, coordinate data governance across government bodies, and advance AI adoption in alignment with Vision 2030. The Authority operates through executive components that implement data management, national information services and AI research/innovation. SDAIA has acted as the national regulator/manager for data governance and a central coordinator for AI strategy and public-sector deployments, and it is the designated authority to supervise implementation of the Kingdom’s Personal Data Protection Law (PDPL) and related national data governance policies. (See: https://sdaia.gov.sa/, https://data.gov.sa/en, https://www.moi.gov.sa/)

Definitions

The following definitions are used in SDAIA’s frameworks and in associated national instruments:

• Controller / Processor: As defined under the Personal Data Protection Law (PDPL) and national data governance policies — entities that determine the purposes and means of processing personal data. (See PDPL materials and implementing rules.)
• National Data Governance Policies: SDAIA-issued framework of policies and interim regulations on classification, sharing, protection and publication of government data (including open-data and freedom-of-information interim arrangements). (See: https://istitlaa.ncc.gov.sa/en/About/Pages/OpenData.aspx.)
• National Data Bank / Data Lake: Centralized government data-sharing and analytics infrastructure operated under SDAIA direction for authorized government analytics and services. (See: https://data.gov.sa/en.)

Governance and Institutional Framework

SDAIA was established by Royal Order on 30 August 2019 as the national authority responsible for setting and coordinating the Kingdom’s national data and AI agenda. The Royal Order created SDAIA and affiliated bodies including the National Data Management Office (NDMO) and the National Centre for Artificial Intelligence (NCAI), and positioned the Authority to operate core national data infrastructure and lead national AI efforts. SDAIA is directly linked to the Prime Minister and coordinates with government ministries, the National Information Center, and other national AI and data centers.

SDAIA’s formal remit includes: issuing national data governance policies and interim regulations; operating or coordinating national platforms (such as a National Data Bank/data lake, national data catalog and data-sharing arrangements); supporting implementation of the Personal Data Protection Law (PDPL) through supervisory, compliance-support and advisory roles; and providing centralized technical capabilities (biometrics, analytics, AI-enabled operations) to support government digital services. (See: https://sdaia.gov.sa/, https://data.gov.sa/en, https://www.moi.gov.sa/.)

Key Focus Areas

• National data governance policies, standards and platforms — including establishment and oversight of a National Data Bank/data lake, a national data catalog, and data-sharing and open-data arrangements operated or coordinated by SDAIA. (See: https://data.gov.sa/en.)
• Supervision and support for PDPL implementation — SDAIA is the designated authority to supervise and support implementation of the Personal Data Protection Law, including establishing a national register for controllers and providing compliance tools and guidance. (See: https://dgp.sdaia.gov.sa/.)
• Operational and technical support for government digital services — centralized capabilities for biometric systems, analytics, and AI-enabled operations to support national projects (including Hajj/pilgrimage platforms and other sectoral deployments). (See: https://www.moi.gov.sa/.)
• Development and stewardship of national AI policy, research and innovation through affiliated centers (e.g., the National Centre for Artificial Intelligence) to drive adoption aligned to Vision 2030.

Implementation Framework

SDAIA issues interim national data governance policies and implements national platforms to operationalize data sharing and analytics while seeking to protect personal data in accordance with the PDPL. Government entities and other controllers are required to register with national data governance systems where applicable and to align data practices with SDAIA-issued policies and the PDPL; SDAIA provides registration services and maintains a national register for controllers. The Authority also publishes guidance, operates compliance-support portals and tools, and coordinates cross-agency technical integration (data catalogs, secure data-lakes, and sharing platforms) to enable compliant data exchange.

Operational implementation is undertaken through SDAIA executive components and affiliated centers (e.g., National Data Management Office, National Information Center, National Centre for Artificial Intelligence) which deliver national information services, data infrastructure, and AI capabilities to government entities and national programs. Major programmatic rollouts — including national data platforms, open-data arrangements and national AI initiatives — have progressed since 2020. (See: https://data.gov.sa/en, https://dgp.sdaia.gov.sa/.)

Monitoring and Evaluation

SDAIA operates compliance-support tools and platforms — assessments, guidance, portals and registries — to help government bodies and other controllers meet PDPL obligations and national data governance standards. The Authority maintains mechanisms for receiving complaints, conducting assessments, and coordinating remedial actions with competent bodies. Monitoring is carried out through supervisory activities and compliance programs, and technical monitoring is supported via integrated national systems (data catalogs, secure sharing mechanisms and national platforms) designed to enable traceable and auditable data exchange while protecting personal data. (See: https://dgp.sdaia.gov.sa/.)

Penalties, Liability, and Appeals

Enforcement and penalties relating to personal data protection and statutory obligations are governed by the PDPL and its implementing regulations. Within that legal framework, SDAIA plays a supervisory, compliance-support and advisory role and coordinates enforcement-related activities with competent enforcement bodies. SDAIA maintains procedures for complaints, assessments and coordination of remedial actions, but legal liability, penalties and formal appeals processes derive from the PDPL and associated executive instruments rather than from SDAIA acting alone. (See: Personal Data Protection Law materials and implementing rules.)

Relationship to Other Instruments

SDAIA’s mandate intersects with other government regulators, ministries and national centers where data sharing, privacy, open data, and AI-enabled services are involved. Key related instruments include the Personal Data Protection Law (PDPL) — a Royal Decree-based law that assigns SDAIA a supervisory role for PDPL implementation — and National Data Governance Interim Regulations that set standards for open data, classification, sharing and protection of government data. Coordination with the National Data Management Office, the National Information Center, and sector ministries is a core part of SDAIA’s operational model. (See: https://rulebook.sama.gov.sa/en/entiresection/9657, https://istitlaa.ncc.gov.sa/en/About/Pages/OpenData.aspx.)

International Alignment

SDAIA’s model — a centralized national authority for data and AI — aligns with approaches adopted by several states that concentrate data governance and AI strategy functions in a single entity to accelerate digital transformation and regulatory coordination. SDAIA engages internationally through summits, memoranda of understanding and cross-border AI/data projects while seeking to align domestic instruments (PDPL, national data governance policies) with international best practices. SDAIA participates in international forums and bilateral engagements to coordinate standards, research and operational cooperation. (See example institutional engagements and announcements on official government channels.)

Implementation Timeline

Sources and References