Saudi Authority for Data and Artificial Intelligence
Government agency of Saudi Arabia
From Wikipedia, the free encyclopedia
The Saudi Data and AI Authority (SDAIA) is a government agency in Saudi Arabia that was established by a royal decree on 30 August 2019.[1] The authority has three other bodies linked to it. Two of which were also created by a royal decree on the same day.[2] These two bodies are a center called "The National Centre for Artificial Intelligence" and an office called The National Data Management Office."[3][2] The third is the National Information Center, which is an existing entity. SDAIA oversees digital platforms such as Nafath (Unified National Access) and Tawakkalna,
| |
| Agency overview | |
|---|---|
| Formed | 30 August 2019 |
| Jurisdiction | Government of Saudi Arabia |
| Headquarters | |
| Employees | 3,000 |
Agency executives |
|
| Website | sdaia |
The Saudi Data and AI Authority (SDAIA) celebrated the launch of its brand identity at an event held at the Ritz Carlton Hotel in Riyadh on 4 March 2020,[4] under the theme 'Data is the Oil of the 21st Century'.
Structure
The authority is directly linked to the Prime Minister and will be governed by a board of directors chaired by the Deputy Prime Minister.[2]
National Data Management Office
The National Data Management Office (NDMO) (Arabic: مكتب إدارة البيانات الوطنية) is one of the affiliated bodies of the Saudi Authority for Data and Artificial Intelligence (SDAIA). It was established in 2019 by royal decree alongside SDAIA and the National Centre for Artificial Intelligence.
NDMO serves as the national regulator for data governance and personal data protection in the Kingdom of Saudi Arabia, responsible for setting national policies, standards and controls governing data management and protection across the public sector.[5][6]
The office oversees compliance with the Data Management and Personal Data Protection Standards, which state that NDMO is the national regulator of both government and personal data, and that all public entities must comply with its policies. It also administers the National Data Governance Interim Regulations, including the Personal Data Protection Interim Regulations, and is expected to assume long-term supervision of data protection under the Personal Data Protection Law (PDPL) following SDAIA’s transitional oversight phase.[7]
Personal Data Protection Law enforcement
Since 14 September 2023, SDAIA has been the competent authority responsible for enforcing the Personal Data Protection Law (PDPL), Saudi Arabia's first comprehensive data protection law. The PDPL was issued by Royal Decree No. M/19 dated 9/2/1443 AH (16 September 2021), amended by Royal Decree No. M/148 dated 5/9/1444 AH (27 March 2023), entered into force on 14 September 2023, and reached full compliance enforcement on 14 September 2024 after a one-year grace period.[8][9]
SDAIA operates the National Data Governance Platform (NDGP), a registry on which data controllers must enrol if they are a public entity, process sensitive personal data, or have processing of personal data as their primary activity within Saudi Arabia. Registration is online and free of charge.[10][11]
Under the PDPL Implementing Regulations, controllers must notify SDAIA of a personal data breach within 72 hours of becoming aware of it, and must inform affected individuals without undue delay where the breach is likely to cause harm. Data subject access requests must be answered within 30 days, extendable where the Data Protection Officer can show that the response requires exceptional effort. Appointment of a Data Protection Officer is mandatory for organisations whose core activities involve large-scale processing of sensitive personal data or large-scale systematic monitoring.[12]
Administrative fines for violations of the PDPL can reach 5 million Saudi riyals per violation, and may be doubled for repeat offenses. Disclosure of sensitive personal data with intent to cause harm or for personal benefit is punishable by imprisonment for up to two years and a fine of up to 3 million Saudi riyals.[13]
In the transitional period set out in the PDPL Implementing Regulations, SDAIA exercises direct supervisory authority; long-term oversight is expected to migrate to the National Data Management Office within SDAIA's organisational structure.[14]
