Saudi SDAIA Drafts PDPL Rule Changes Including Data Localization

SDAIA's 6 October 2026 consultation draft would require in-Kingdom data storage, 72-hour breach notifications without a harm threshold, expanded DPIA and DPO duties, and controller registration; comments close 5 November 2026.