Web Content Viewer

Registration of Private Entities

Registration of Private Entities

The Saudi Data & AI Authority (SDAIA) is responsible for overseeing the implementation of the Personal Data Protection Law, issued by Royal Decree No. (M/19) dated 09/02/1443 AH, and Its amendments. SDAIA also ensures controllers compliance through building a unified national register for controllers who process personal data within the Kingdom. Including, public and private entities, non-profits, and individuals. Registration on the platform is determined according to the cases stipulated in Article (2) of Rules Governing the National Register of Controllers within the Kingdom, which can be viewed here.

Requirements

  • Account on Absher
  • Active commercial registration
  • Delegate a representative of the entity using the authorization service at the Saudi Business Center.

If you encounter any technical issues or inquiries regarding the registration procedures on Platform, please submit a request via the Contact Us option.

  • The authorized person should log in to the Saudi Business Center Platform (https://business.as/).
  • Select “Business Platform”.
  • Sign in using the National Single Sign-On (Nafath).
  • Under Electronic Services navigate to “Inquiries and general services” and choose “Saudi Business Center”.
  • Click on Delegations service.
  • Create a new Delegation and complete the necessary steps.
  • Select the Commercial Register for the entity.
  • Select (Saudi Data and Artificial Intelligence Authority “SDAIA”) as a service provider.
  • Select the name of service (representing and registering on National Data Governance Platform and completing procedures).


To register on the National Data Governance Platform, the representative need to follow these steps:

  • Select Private Entity Registration.
  • Click on Start Service.
  • Sign in as a representative through the National Single Sign-On (Nafath).
  • Under control entities, choose private entity.
  • Click on “Import Delegation”.
  • Choose the private entity for which you want to complete registration procedures.
  • Evaluate eligibility for registration according to the cases stipulated in Article (2) of Rules Governing the National Register of Controllers within Kingdom.
  • Complete entity profile information.
  • Assess the extent to which appointing a DPO is mandatory to, according to the cases stipulated in Article (32) of Implementing Regulations of Personal Data Protection Law.
  • Evaluate eligibility for registration in Artificial Intelligence Ethics.
  • Issue a certificate for the national register for personal data protection.


The owner of an Establishment can log into the platform and complete the registration process steps directly, if does not wish to delegate a representative through the Saudi Business Center.

Rules and Guidelines

Introduction

Pursuant to Article (30), paragraph 4, of the Personal Data Protection Law Issued by Royal Decree No.(M/19)dated 9/2/1443 AH, amended by Royal Decree No.(M/148)dated 5/9/1444 AH, which provides: "The Competent Authority, in order to carry out its duties related to supervising the implementation of the provisions of the Law and Regulations, may:...(C) Specify the appropriate tools and mechanisms for monitoring Controllers’ compliance with the provisions of the Law and the Regulations, including maintaining a National Register of Controllers for this purpose". In accordance with Article (34) of the Implementing Regulation of the Law, which mandates that the Competent Authority shall issue the rules for registration in the National Register of Controllers, these Rules are hereby established. The purpose of these Rules is to inform and monitor Controllers within the Kingdom of the scope of their obligation to register on the National Data Governance Platform. Separate registration rules for Controllers located outside the Kingdom will be issued by the Competent Authority.

Article 1: Definitions

For the purposes of these Rules, the terms and phrases used herein shall have the meanings ascribed to them in Article (1) of the Personal Data Protection Law Issued by Royal Decree No. (M/19) dated 9/2/1443 AH and its amendments, and Article (1) of the Implementing Regulation of the Law, unless expressly defined within the body of these Rules. The following terms and phrases, wherever mentioned, shall have the meanings assigned thereto, unless the context requires otherwise:

  1. Rules: The Rules Governing the National Register of Controllers within the Kingdom.
  2. Competent Authority: Saudi Data & AI Authority (SDAIA).
  3. The Platform: National Data Governance Platform.
  4. National Register: A register that includes public, private, and individuals Controllers within the Kingdom who process personal data, with the aim of monitoring and following up on Controllers and assisting them in raising the level of compliance with the provisions of the law and regulations, in addition to provide services related to the protection of personal data.
  5. Representative: Any natural person designated by the Controller for the purposes of completing the registration procedures on the Platform.
  6. Individual: Any natural person who processes personal data for purposes exceeding personal or family use.

Article 2: Scope and Objective

These Rules shall be applicable to Controllers subject to the application scope of the Personal Data Protection Law and are mandated to register on the Platform in any of the following instances:

  1. If the Controller is a public entity.
  2. If the Controller’s main activity is based on personal data processing.
  3. If the controller processes sensitive data.
  4. If the individual processes personal data for purposes exceeding personal or family use.

This aims to build a national register for public and private Controllers and individuals who process personal data within the Kingdom, in addition to monitoring and following up on Controllers, assisting them in raising their level of commitment to implementing the provisions of the law and regulations and providing services related to personal data protection by registering on the Platform.

Article 3: Controller Delegate Appointment

  1. Public Entity: A representative shall be appointed through the registration form sent by the Competent Authority.
  2. Private Entity: A representative shall be appointed through the Platform by the authorized person.
  3. Individuals: Individuals are their own representatives and are not allowed to designate other people.

Article 4: Registration Procedures

  1. The representative must complete the registration process on the Platform when one of the conditions stipulated in Article (2) of these rules is met. The representative should also determine the need to appoint a Personal Data Protection Officer in accordance with the conditions stipulated in Article (32) of the executive regulations of the Personal Data Protection Law and the rules for appointing a Personal Data Protection Officer.
  2. Individuals must complete the registration process on the Platform when one of the conditions stipulated in Article (2) of these rules is met.

Article 5: Profile Data

  1. The Controller representative shall be responsible for completing all required fields on the Platform, including:
    A. Controller Entity Data: Entity logo, official email and contact number, and headquarters.
    B. Representative Data: Official email and contacts number.
  2. Individuals must complete all required fields on the Platform, including official email and contact number.

Article 6: Circumstances for Appointing a Personal Data Protection Officer

The Controller shall appoint one or more individuals to be responsible for the protection of personal data in accordance with the cases stipulated in Article (32) of the Executive Regulations of the Personal Data Protection Law and the rules for appointing a Personal Data Protection Officer.

Article 7: Information of the Personal Data Protection Officer

  1. If a Personal Data Protection Officer is appointed in accordance with Article (6) of these rules, the representative shall fill in the Personal Data Protection Officer's information on the Platform to create the Controller’s account.
  2. If the Personal Data Protection Officer is an employee of the Controller or an external contractor, the representative must provide the following information:
    A.National ID/residency number for data retrieval purposes.
    B.Date of birth for verification of the entered national ID/residency number.
    C.Official contact information (phone number, e-mail).
  3. If the Personal Data Protection Officer is a contractor located outside the Kingdom, the representative must provide the following information:
    A.First and last name.
    B.Official email.
    C.Official contact number.
  4. The representative may appoint themselves as the Personal Data Protection Officer if they are appointed by the Controller.

Article 8: Obligations

  1. When using the platform, the representative is committed to all of the following:
    Complete the entity’s registration.
    A.Fill in the data of the Personal Data Protection Officer in accordance with Article (7) of these rules.
    B.Fill in the information of the entity’s Chief Data (if any).
    C.View the results of the compliance assessment and the services provided.
    D.Use the Platform services, if a Personal data protection officer has not been appointed in accordance with Article (6) of these rules.
    E.Update the controller’s data on regular basis to ensure it is up-to-date.
  2. When using the platform, individuals are committed to all of the following
    A.Complete the registration process.
    B.Use Platform services.
    C.Update data regularly to ensure it is up-to-date.
  3. The Personal Data Protection Officer - if appointed - is obligated to use the Platform services stipulated in Article (12) of these Rules.

Article 9: Representative Replacement

  1. The public Controller must communicate with the Competent Authority if it wishes to replace the representative, using the official means of communication available on the Platform.
  2. If the private Controller wishes to replace the representative, they should use the form available on the Platform.

Article 10: Registration Certificate Issuance

  1. The registration certificate shall be issued as soon as the registration process, stipulated in Article (4 (of these rules, is completed. The certificate shall include the following information:
    A.Registration Serial Number.
    B.Entity/Individual Name.
    C.Entity Logo.
    D.Entity Address.
    E.Official Email of the Entity/Individual.
    F.Official Contact Number of the Entity/Individual.
    G.The Date of Issue and End Date.
    H.QR code.
  2. The certificate will be valid for (5) years as maximum.
  3. The Competent Authority shall notify the Controller of the impending expiration of their registration certificate no less than thirty (30) days prior to the expiry date. Following the expiration of the certificate, the Controller may continue to access Platform Services for a grace period of up to five (5) days. However, access to services beyond this grace period shall be contingent upon the Controller submitting a renewal request.

Article 11: Making Registration Certificate Available to the Public

The Competent Authority allows the public to verify the registration of Controllers in the national registry by reviewing the registration certificate and verifying its authenticity, without imposing any requirements. This measure is taken to protect personal data and enhance confidence in the services provided.

Article 12: Services Provided on the Platform

The Platform offers a range of e-services aimed at protecting data as national assets and safeguarding the rights of individuals from illegal violations. These services include:

  1. Personal Data Breach Notification Service: This service enables Controllers to notify a personal data breach incident to the Competent Authority immediately after its occurrence, within a period not exceeding (72) hours of becoming aware of the incident, this reporting is necessary if the incident would harm the personal data or the data subject or if it conflicts with their rights or interests, as outlined in Article (24) of the Executive Regulations of the Personal Data Protection Law.
  2. Privacy Impact Assessment Service: This tool analyzes the impact of processing personal data on the products and services provided. It helps determine the scope and objectives of the processing, identify regulatory justifications, and assess the risks associated with processing personal data.
  3. Legal Support Service: This service provides support and guidance to assist public entities in understanding the Personal Data Protection Law and its regulations. This includes interpreting stipulated provisions and requirements as well as offering guidance on relevant manuals and regulations, thereby contributing to ensuring effective application and achieving desired goals.
  4. Compliance Assessment Service: This service involves periodically evaluating compliance with specific standards and requirements to monitor the level of commitment and ensure the effectiveness of actions taken to implement laws, regulations, and policies. It also helps identify incorrect practices to address them and improves business practices and procedures.

Article 13: Review and Amendment

The Competent Authority reviews these rules whenever necessary and may make any amendments or updates to such rules.

Article 14: Enforcement

These rules will be effective from the date of publication on the official website of the Competent Authority.

Attachment: Registration Form

Required Fields
 Entered by Public Controller
Entity Name in Arabic
Entity Name in English
Entity's Unified Number (Optional)
Representative Name in Arabic
Representative National ID



The registration aims to building a national register of controllers, including public entities, private entities, and individuals that process personal data related to individuals residing in the Kingdom, and support them by providing services related to the protection of personal data and ensuring their compliance with the law and its implementing regulations.

Any controller that collects and processes the personal data of individuals who are citizens or residents of Kingdom of Saudi Arabia.

Any public entity, natural person or private legal person that specifies the purposes and manner of processing personal data, whether the data is processed by that controller or by the Processor.

Registration is mandatory in the following situations:
1.If Controller processes sensitive data.
2.If the Controller’s main activity is based on processing personal data.

As stipulated in Article (2) of Rules Governing the National Register of Controllers within Kingdom, which can be viewed here.


1.The authorized person should log in to the Saudi Business Center Platform (https://business.sa/).
2.Select “Business Platform”.
3.Sign in using the National Single Sign-On (Nafath).
4.Under Electronic Services navigate to “Inquiries and general services” and choose “Saudi Business Center”.
5.Click on Delegations Services.
6.Create a new Delegation and complete the necessary steps.
7.Select the Commercial Register for the entity.
8.Select (Saudi Data and Artificial Intelligence Authority “SDAIA”) as a service provider.
9.Select the name of service (representing and registering on National Data Governance Platform and completing procedures).

An entity delegate who was appointed in Authorization System of the Saudi Business Center

1.Sign in through the National Single Sign-On (Nafath)
2.Evaluate the eligibility for registration
3.Complete entity profile information
4.Assess the necessity of appointing a DPO
5.Evaluate the eligibility for registration in Artificial Intelligence Ethics
6.Issuing a certificate for the national register for personal data protection

To easily view the steps, click on Registration of Private Entities

Any natural person appointed by government or private controller, non-profit to complete entity registration procedures on the Platform. when using Platform, the representative must comply with the following:
•Complete entity registration procedures.
•Fill out the details of DPO as stipulated in Article (7) of Rules Governing the National Register of Controllers Within Kingdom.
•Fill out the details of AI System Owner (if any).
•View the assessment results and services provided on Platform.
•Update the controller’s data on regular basis to ensure it is up-to-date.

Any natural or legal person that applies or uses AI systems to achieve certain goals.

The Saudi Data & Al Authority (SDAIA) does not require any criteria regarding the entity’s representative, and it is subject to the discretion of the controller.

  • Entity's official e-mail
  • Entity's official contact number
  • Primary address
  • Headquarters
  • Entity logo

DPO is one or more natural persons appointed by Controller to be responsible for monitoring the implementation of the provisions of the Law and its Implementing Regulations, overseeing Procedures applicable by Controller, and receiving requests relate to Personal Data in accordance with provisions of the Law and its Implementing Regulations.
Required Data to be registered:

•ID number.
•Date of birth.
•Official contact information (mobile number and official e-mail).

Click here for an assessment to determine whether the appointment of a personal data protection officer is mandatory.

The services are used by the personal data protection officer (DPO) or the entity’s representative if the Controller entity is not obligated to appoint a personal data protection officer, according to the cases stipulated in Article (32) of the Implementing Regulations of PDPL.

Currently there is no registration fee.

Controller shall be notified thirty (30) days prior to the expiration date of the registration certificate. The certificate may be renewed after that.

Another certificate with the previous registration number is issued with a new issue date

The public can use the search service in the National Registry for Personal Data Protection by entering the entity’s name or registration number

Registration certificate is available to the public and it includes the following information:
•Registration serial number.
•Entity name.
•Entity logo.
•Entity official e-mail.
•Entity official contact number.
•Primary address.
•Issue and expiration date.
•QR code.

Platform provides a service for updating previously entered official information

The Saudi data & Al Authority(SDAIA) provides several services to the Controllers

Click here to view the available e-services


If you have any suggestions or technical issues, please submit a request via contact us option

Level 1: Aware.
Level 2: Adoptive.
Level 3: Confirmative.
Level 4: Assured.
Level 5: Visionary.

Any entity or individual involved in developing AI systems.

Yes, the validity period is 1 year.

AI ethics digital badges are optional badges awarded to an AI product after it advances and registers on the platform. These badges aim to encourage entities to enhance their adoption of AI ethics in their products.

Any entity or individual involved in developing AI systems.

AI Ethics Assessment is a tool designed to enable entities to conduct a comprehensive and systematic analysis of the extent of their compliance with ethical standards in the development and application of artificial intelligence technologies. The process begins by identifying and evaluating all potential risks and the severity of their impact. The tool also includes questions in each principle of ethics to assess the level of ethical commitment of the artificial intelligence model.

Back