SDAIA Registration Under the PDPL: Who Must Register on the National Data Governance Platform and How

WaqiSec Compliance Team · Last reviewed: 2026-10-14

What is SDAIA registration under the PDPL?

SDAIA registration is the entry of a controller (the organization that decides why and how personal data is processed) into the National Register for Personal Data Protection. The register lives on the National Data Governance Platform, which SDAIA operates at dgp.sdaia.gov.sa. Successful registrants receive a registration certificate that anyone can verify on the platform.

The duty does not sit in the PDPL itself. The 2023 amendments to the law removed the express registration article and left SDAIA to set its own oversight tools. The Implementing Regulations then gave SDAIA the power to decide which controllers must register, and SDAIA used that power in its Rules Governing the National Register of Controllers within the Kingdom, published in July 2024.

Who must register on the National Data Governance Platform?

Article 2 of SDAIA's Rules lists four cases. Meeting any one of them is enough:

A business outside these four cases is not required to register under the current Rules. That does not exempt it from the rest of the PDPL: the privacy notice, records of processing, breach notification and data subject rights apply to every controller. Sector regulators also push registration. In November 2025 the Ministry of Education called on private universities, colleges and schools to register, and SDAIA made a similar call to non-profits in January 2025.

Why registration matters more in 2026

For the first two years many companies treated registration as a box to tick. Three developments changed that:

1. The Compliance Verification Form. In July 2026 SDAIA began sending registered controllers a form that asks them to evidence their governance, legal bases, third parties, retention and destruction, data subject rights, cross-border transfers, incident response and DPO appointment (Clyde & Co). Registration puts you on that list.
2. Active enforcement. SDAIA's violation committees announced 48 decisions for 2025 and a further batch in June 2026, including failure to appoint a DPO where required. See our guide to PDPL penalties and SDAIA enforcement.
3. Platform services depend on it. Breach notification to SDAIA within 72 hours, privacy impact assessment and the self-assessment tool all run through the platform account that registration creates.

What you need before you start

• An active commercial registration that has not been struck off.
• A representative authorized through إدارة التفاويض (authorizations) on the Saudi Business Center (business.sa), choosing SDAIA's service for representation and registration on the platform. The owner can also register directly.
• A Nafath login for the representative.
• The entity profile: logo, official email, phone and head office address.
• Your answer to the DPO question. The platform asks whether a Data Protection Officer is mandatory for you under Article 32 of the Implementing Regulations. Read our DPO guide first and have the DPO's details ready if one is required.

Registration steps for a private company

1. On business.sa, the owner authorizes the representative for SDAIA's registration service.
2. On dgp.sdaia.gov.sa, choose الجهات الخاصة (private entities) and press بدء الخدمة (start service).
3. Log in with Nafath.
4. Complete the entity profile and the representative profile.
5. Answer the DPO assessment. If a DPO is mandatory, enter their details.
6. Complete the remaining questions the platform shows (it also checks eligibility for AI ethics registration).
7. Receive the registration certificate. Save it and note its expiry date.

The representative is responsible for keeping the entity's data on the platform up to date. The representative and the DPO are different roles, although one person can hold both.

Public entities and non-profits

Government entities follow a different route. The entity sends SDAIA a letter requesting registration with the representative's details, SDAIA creates the account, and the representative then logs in with Nafath to complete the profile and DPO check. Non-profit organizations have their own registration route on the platform.

Companies outside Saudi Arabia

Until recently a foreign company without a Saudi commercial registration could not open an account. In October 2026 Clyde & Co reported that SDAIA has opened controller registration for organizations outside the Kingdom. The process requires an authorized representative plus identity verification and a digital identity issued through the Ministry of Foreign Affairs. Clyde does not say whether the representative must be located in Saudi Arabia, so check the platform's current requirements before you start. Our guide to cross-border transfers covers the transfer rules that usually matter most to foreign companies.

What happens after you register

• You can use the platform's services: breach notification, privacy impact assessment, compliance self-assessment and complaints handling.
• You must keep the representative and DPO details current.
• You may receive SDAIA's Compliance Verification Form. No public deadline or delivery channel has been announced, so prepare the evidence now rather than when the form arrives.

Proposed changes in the October 2026 draft

SDAIA published draft amendments to the Implementing Regulations on the Istitlaa platform, with comments open until 5 November 2026. If adopted, they take effect 60 days after publication in the Official Gazette. According to Clyde & Co and Al Tamimi, the draft would:

• move the registration triggers into Article 34 of the Regulations and add controllers that process data of people lacking legal capacity and those that transfer or disclose personal data outside the Kingdom;
• require registrants to submit their records of processing;
• require the DPO appointment and contact details to be recorded on the platform straight away and updated when the DPO changes;
• give controllers 20 business days to answer SDAIA requests.

These are proposals, not current law. Treat them as a signal of where SDAIA is heading.

Common mistakes

• Assuming every company must register, or that no company needs to. Check the four cases and keep a short written assessment.
• Registering without a DPO decision. The platform asks; answer it from a documented assessment.
• Letting the representative's details go stale when that person leaves.
• Registering and stopping there. Registration invites the Compliance Verification Form.
• Confusing the controller register with SDAIA's separate register of data service and product providers.

SDAIA registration checklist

• We assessed the four registration cases and recorded the result.
• Our commercial registration is active.
• Our representative is authorized on business.sa and has Nafath access.
• We decided whether a DPO is mandatory and have the DPO's details if so.
• We hold the registration certificate and know its expiry date.
• Our privacy notice, records of processing, breach procedure and rights procedure are ready for a Compliance Verification Form.

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.