The KSA PDPL &
Artificial Intelligence (AI)

What

The integration of AI in Saudi Arabia necessitates careful consideration of data privacy under the PDPL, especially with the rise of generative AI and its unique challenges.

Why it Matters

AI systems, particularly generative AI, rely on extensive datasets. Non-compliance can lead to PDPL violations and reputational damage, along with a lack of customer buy-in.

Key Considerations

• AI systems processing personal data are subject to PDPL, with specific nuances for generative AI.

• Implement controls to minimize the PII used in prompts, especially for Large Language Models (such as: ChatGPT, Perplexity, and Claude).

Practical Steps

• Establish clear policies and procedures regarding the use of generative AI tools within your organization.

• Provide training to employees on the responsible and compliant use of AI, particularly concerning data privacy.

• Implement technical controls to govern the data used in AI systems, focusing on minimization and security.

Official Resources for Further Reading

• The KSA’s Personal Data Protection Law (v2 April 2023)

• Saudi Data & AI Authority (official SDAIA website)

• Generative Artificial Intelligence Guidelines from SDAIA (v1 January 2024)

Related Resources from Pyxos

• Understanding KSA’s PDPL in the Age of AI: Best Practices for Compliance & Growth (event materials available here)

  • Details: Workshop in partnership with Riyadh Chamber of Commerce & Industry and Bayan Academy (February, 2025)