In many Saudi organisations, AI tools have arrived at work without anyone formally introducing them. Staff use them to draft emails, summarise reports, write job descriptions and translate documents. Much of that is genuinely useful.
But every time someone pastes information into an AI tool, they're sharing it with another company. And in Saudi Arabia, if that information is about a person, the Personal Data Protection Law (PDPL) applies.
This guide explains what the PDPL means for everyday AI use at work, what should never go into a public AI tool, and what managers can do now to keep teams productive and compliant.
A quick introduction to the PDPL
The PDPL is Saudi Arabia's main data protection law. It is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). The law came into effect in September 2023, and organisations had until September 2024 to comply. SDAIA is now actively enforcing it.
It applies to the processing of personal data about individuals in Saudi Arabia: names, contact details, ID numbers, employment records, customer details and anything else that identifies a person.
Some personal data is classed as sensitive data and needs extra care. This includes health information, credit and financial data, biometric and genetic data, criminal records, and information about a person's ethnic or tribal origin or their religious or political beliefs.
The penalties are significant. Breaches can lead to fines of up to SAR 5 million, which courts can double for repeat offences. Disclosing sensitive data with intent to harm someone or gain a benefit can lead to up to two years' imprisonment and/or a fine of up to SAR 3 million.
Where AI tools fit in
Most of the risk doesn't come from AI itself. It comes from what people put into it.
When an employee pastes text into a public AI tool, that text leaves the organisation and goes to the tool's provider, often on servers outside Saudi Arabia. Depending on the tool and its settings, it may be stored, reviewed or used to improve the service.
That matters under the PDPL for three reasons:
Disclosure. Sharing personal data with a third party your organisation has no agreement with may count as an unauthorised disclosure.
Transfers outside the Kingdom. The PDPL and SDAIA's transfer regulations restrict sending personal data outside Saudi Arabia. Transfers need a permitted purpose and, in many cases, specific safeguards and a risk assessment. An employee pasting customer details into a free online tool doesn't meet any of those conditions.
Breach reporting. If personal data is exposed, organisations may need to notify SDAIA within 72 hours of becoming aware of it.
SDAIA's own Generative AI Guidelines make the same point: organisations should take a firm stance on employees entering classified or personal information into third-party AI tools, and users must check AI output for accuracy themselves.
What should never go into a public AI tool
A simple rule helps: if it identifies a person, or it's confidential to the business, it stays out, unless the tool has been approved by your organisation for that purpose.
In practice, that means:
- Names, ID numbers, phone numbers or addresses of employees or customers
- CVs, performance reviews, disciplinary or grievance notes
- Medical notes, sick leave details or anything health-related
- Salary, bank or credit information
- Customer complaints or case notes that identify someone
- Contracts, pricing, financial results or anything marked confidential
What's usually fine is work that doesn't involve personal or confidential details: drafting a general announcement, improving the wording of a policy summary, brainstorming training ideas, or creating a template that staff fill in afterwards.
Five practical steps for managers
1. Assume your team is already using AI
Banning AI rarely works. People keep using it, just less openly. It's more effective to acknowledge it, set clear boundaries, and show people how to use it well.
2. Agree which tools are approved
Work with IT to confirm which AI tools staff may use for work, and on what terms. Business versions of some tools offer stronger data protections than free consumer versions. Make the approved list easy to find.
3. Give people a simple "never paste" list
A one-page list, like the one above, does more than a long policy nobody reads. Put it where people work: in the team channel, the intranet, or pinned in the tool itself.
4. Teach people to remove personal details first
Many tasks still work without the personal details. Show staff how to replace names with roles ("Employee A", "the customer"), remove numbers and identifiers, and add the specifics back afterwards, outside the tool.
5. Make checking the output a habit
AI tools can produce confident, polished and wrong answers. SDAIA's guidelines put the responsibility for checking accuracy on the user. Every AI-assisted document should be reviewed by someone who knows the subject before it's used or sent.
Why training makes the difference
Most PDPL risk from AI comes from good intentions: someone trying to save time, without knowing where the line is. Clear rules help, but people remember what they've practised far better than what they've read.
That's why practical, hands-on training works better than a policy alone. Staff try real tasks from their own jobs, learn what's safe to share, and build habits for checking what comes back. For more on why this is now a core workplace skill, see our article on why AI literacy is now a baseline skill.
Our Practical AI for Business Teams course is delivered live online and tailored to each organisation, including the data protection rules that apply where your team works. Not sure where to start? Take our training needs quiz for a quick recommendation, or book a free consultation to talk it through.
This article is general information, not legal advice. For advice on your organisation's PDPL obligations, speak to a qualified legal adviser.