PDPL and AI, data residency and where personal data goes

The PDPL came into force in September 2023, and SDAIA began enforcing it in September 2024 after a one-year grace period. SDAIA is the competent authority. The law does not mention AI by name, and it does not need to: it covers any processing of personal data about individuals in the Kingdom.

Where AI touches personal data

• A question typed into an assistant that names an employee, a customer or a patient.
• Documents an agent reads: CVs, contracts, case files, HR records.
• Logs and evidence the platform stores, such as usernames on servers.
• The model provider’s own logs, if the model runs as someone else’s service.

What the PDPL asks of you

At the level that matters for an AI project, the law asks controllers to:

• Have a lawful basis and a stated purpose, and use no more personal data than that purpose needs.
• Protect personal data with appropriate organisational and technical measures.
• Respect data subjects’ rights, including access and correction.
• Transfer personal data outside the Kingdom only under the conditions the law and its transfer regulation set.
• Notify SDAIA of a personal data breach, as the implementing regulations require.

Read the law and its regulations on SDAIA’s site; this summary is not legal advice.

Data residency: why self-hosting matters

When using an AI service, review where requests are processed and how they are retained. Self-hosting lets you choose where the platform and model run, but a server location alone does not establish that data stays inside the Kingdom. Verify all processing, storage, support and backup paths and their connected external services.

Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.

Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.

The privacy page lists exactly what the platform stores and where it lives under each deployment model.

How AcTree supports PDPL work

Where personal data is processed

Customer-controlled inference and execution boundaries.

Who can see it

Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.

A record of administrative changes

Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.

Your purpose, legal basis, retention periods and records of processing stay your organisation’s work, and so does any decision that affects a person. For CV screening, the agent organises and summarises against your criteria and a person decides.

A PDPL checklist for an AI pilot

1. List the personal data the pilot’s questions and documents will contain.
2. Confirm where the model runs and where conversations are stored.
3. Limit which teams and hosts the agent can reach.
4. Agree retention for conversations and evidence before you start.
5. Record the processing in your records of processing activities.

The HR and GRC films in the use-case library show how that looks in practice, with sample data.