PDPL & data residency: a checklist for MENA AI teams

AI teams in the region tend to treat data protection as a deployment problem — something to solve when the model ships. In practice, the highest-risk step often happens much earlier: the moment call recordings, chat logs, documents or medical notes are handed to an annotation workforce. That handoff is a disclosure, frequently a cross-border transfer, and always something a regulator can ask you to account for.

The PDPL, briefly

Saudi Arabia's Personal Data Protection Law (PDPL) was issued by Royal Decree M/19 in September 2021, substantially amended in March 2023, and came into force on 14 September 2023, with a one-year grace period for compliance that ended on 14 September 2024. It is supervised by the Saudi Data & AI Authority (SDAIA) and is supplemented by Implementing Regulations and dedicated Data Transfer Regulations.

Three features matter most for AI data work:

• Broad scope. The law applies to any processing of personal data related to individuals in the Kingdom — including by entities outside Saudi Arabia. "Personal data" includes voice recordings; names, contact details and identifiers inside chat logs and documents; and anything that renders a person identifiable in combination.
• Sensitive data is a separate tier. Health data, credit and financial data, biometric and genetic data, and data revealing religious or ideological beliefs carry stricter conditions. Unlawful disclosure of sensitive data is the PDPL's most serious offense — punishable by up to two years' imprisonment and/or a fine of up to SAR 3 million, with fines up to SAR 5 million for other violations and the possibility of doubled penalties for repeat offenses.
• Cross-border transfers are regulated, not banned. The 2023 amendments and the Data Transfer Regulations allow transfers under specific conditions — adequacy, appropriate safeguards such as standard contractual clauses or binding common rules, and defined exceptions — generally with risk assessment obligations. But every mechanism adds paperwork, review and ongoing accountability. Keeping the data in-Kingdom is not the only lawful path; it is simply the path with the fewest moving parts.

Why annotation is the exposed step

A typical labeling engagement copies raw production data — the most identifying form of it — to a vendor, whose annotators view every record in full. If that vendor routes tasks through a global crowd, your call recordings may be listened to on personal laptops across a dozen jurisdictions, outside any transfer mechanism you have assessed. Under the PDPL you remain the controller throughout: the vendor's shortcuts are your liability.

This is why "where is the data processed?" is the single most clarifying question you can ask a data partner. Not where the company is headquartered, and not where the servers are — where the humans who open each record sit, and under what contractual and technical controls.

The regional picture

Saudi Arabia is not an outlier. Most major MENA markets now have comprehensive data protection statutes, each with its own transfer rules and regulator:

For a team operating across the region, the practical consequence is simple: architecting for the strictest applicable regime — in-region processing, documented lawful basis, minimal disclosure — usually satisfies the rest with little extra work.

The checklist

Before any dataset leaves your environment for annotation, alignment or evaluation, you should be able to answer yes to each of these:

1. Data mapping. Do we know exactly which fields in this dataset are personal data, and which are sensitive under the PDPL's definitions (health, financial, biometric, beliefs)?
2. Minimization. Have we removed or masked every field the labeling task does not require? Annotators rarely need names, phone numbers or account IDs to label intent.
3. Lawful basis. Is the processing covered by consent or another recognized basis, and does our privacy notice actually mention improvement of AI systems?
4. Residency. Do we know the physical location of storage, of processing, and of the annotators themselves? Is each location consistent with our transfer obligations?
5. Contracts. Does the data processing agreement bind the vendor to PDPL-consistent terms — purpose limitation, confidentiality, sub-processor disclosure, breach notification timelines, deletion on completion?
6. Workforce controls. Are annotators under individual NDAs, working in access-controlled environments, with no local downloads and full audit logs per record?
7. Retention. Is there a dated, verifiable deletion plan for raw data and intermediate artifacts once deliverables are accepted?
8. Incident path. If a record is exposed, does the vendor's notification commitment leave us enough time to meet our own regulatory deadlines?