What the laws say, who they hit, when they bite, and what to do — in one place, with the official sources.
The law existed since 2020; the operating manual arrived 1 November 2025. Registration, a mandatory Data Protection Officer, breach reporting, and licensed cross-border transfers become fully enforceable when the reconciliation period ends — 1 November 2026.
SDAIA's enforcement committees are already issuing decisions — 48 reported in February 2026, covering marketing without consent, missing lawful basis, unauthorized disclosure and weak security controls. Amendments to the Implementing Regulation are under consultation.
01Map where personal data lives — every system, every export.
02Name who answers for it — a registered DPO where required.
03Govern the AI your people already use — one audited gateway, not a policy PDF.
04License your cross-border transfers before you need them.
05Keep receipts — consent, processing records, breach logs.
Yes — processing employees' personal data is processing under the law, wherever the AI sits. What changes is whether the data crosses a border or a third party; governing that path is the obligation.
The law and its Executive Regulations are in force; the one-year reconciliation period ends 1 November 2026, when registration, DPO and licensing obligations become enforceable.
Really enforcing: full enforcement began 14 September 2024, and SDAIA's committees issued 48 violation decisions reported in February 2026.
DEBO puts one audited gateway between your data and any AI model: only structure and certified aggregates cross, every send is leak-checked and logged, and every answer carries a receipt — the records regulators ask for, produced as a by-product of using AI.
DEBO