Saudi Arabia PDPL Implementing Regulation: decisions based on automated processing

Binding law — in force AI-adjacent law

Tell people whether decisions will be based entirely on automated processing (Saudi PDPL Implementing Regulation Art. 4(5)(c))

Implementing Regulation of the PDPL, Art. 4(5), including (c) (information on decisions based entirely on automated processing) · official text · In force: applies since 14 Sep 2024 · SA

Under Art. 4(5) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, a controller whose activities include, on a large scale or repeatedly, making decisions based on automated processing of personal data must take the necessary measures to tell the data subject what Art. 4(1) requires and, in addition, whether decisions will be based entirely on automated processing of personal data ((c)), with the means of collecting and processing sensitive data and the measures taken to protect personal data ((a)-(b)). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect a privacy notice that never says whether decisions are automated.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision
• Controllers (public entities, natural persons and private legal persons that set the purpose and manner of processing) that make decisions about individuals based on automated processing of their personal data, for processing in the Kingdom and processing outside it of data on individuals residing in the Kingdom (Law Art. 2(1), read, not stored). The Regulation applies from the Law's entry into force (Art. 38), 2023-09-14 as SDAIA states it, with SDAIA's one-year grace period to 2024-09-14. Arabic text authoritative.
• Not covered:
  • An individual processing personal data for purposes not exceeding personal or family use, within their family or limited social circle (Regulation Art. 2(1)-(2))
• Whether it applies depends on facts outside the code; a person has to decide.

# Privacy policy
We collect your name, contact details and transaction history to provide our services.

# Privacy policy
We collect your name, contact details and transaction history to provide our services.

## Automated decisions
Decisions made solely by a computer program: instant approval or decline of credit limit increases
(uses your income, repayment history and current balances).
Decisions a computer program substantially helps us make: fraud reviews, where a model scores each
transaction (uses transaction amount, merchant, device and location) before a staff member decides.

Rule id sa-pdpl-regs.automated-decision-notice · review status: primary source derived

Binding law — in force AI-adjacent law

Consent must be explicit where decisions will be based entirely on automated processing (Saudi PDPL Implementing Regulation Art. 11(2)(c))

Implementing Regulation of the PDPL, Art. 11(2), including (c) (explicit consent where decisions are based entirely on automated processing) · official text · In force: applies since 14 Sep 2024 · SA

Under Art. 11(2)(c) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, the data subject's consent must be explicit where decisions will be based entirely on automated processing of personal data; explicit consent is consent given directly and explicitly, in any form, that shows acceptance of the processing, cannot be read otherwise and can be proven (Art. 1(9)). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect model output that decides about a person with no explicit-consent check and no person deciding first.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision
• Controllers (public entities, natural persons and private legal persons that set the purpose and manner of processing) that make decisions about individuals based on automated processing of their personal data, for processing in the Kingdom and processing outside it of data on individuals residing in the Kingdom (Law Art. 2(1), read, not stored). The Regulation applies from the Law's entry into force (Art. 38), 2023-09-14 as SDAIA states it, with SDAIA's one-year grace period to 2024-09-14. Arabic text authoritative.
• Not covered:
  • An individual processing personal data for purposes not exceeding personal or family use, within their family or limited social circle (Regulation Art. 2(1)-(2))
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id sa-pdpl-regs.explicit-consent-for-automated-decisions · review status: primary source derived

Binding law — in force AI-adjacent law

Assess in writing the impacts and risks of making decisions based on automated processing (Saudi PDPL Implementing Regulation Art. 25(1)(c))

Implementing Regulation of the PDPL, Art. 25(1), including (c) (impact assessment where the controller's activity includes decisions based on automated processing) · official text · In force: applies since 14 Sep 2024 · SA

Under Art. 25(1)(c) of the Implementing Regulation of Saudi Arabia's Personal Data Protection Law, a controller must prepare a written and documented assessment of the potential impacts and risks to data subjects of processing their personal data where its activity includes, on a large scale or repeatedly, making decisions based on automated processing of personal data (among other cases). The Arabic text is authoritative; the Regulation applies from the Law's entry into force (Art. 38), which SDAIA states was 2023-09-14, with a one-year grace period to 2024-09-14. Detect the absence of an impact assessment for the automated decision system.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision
• Controllers (public entities, natural persons and private legal persons that set the purpose and manner of processing) that make decisions about individuals based on automated processing of their personal data, for processing in the Kingdom and processing outside it of data on individuals residing in the Kingdom (Law Art. 2(1), read, not stored). The Regulation applies from the Law's entry into force (Art. 38), 2023-09-14 as SDAIA states it, with SDAIA's one-year grace period to 2024-09-14. Arabic text authoritative.
• Not covered:
  • An individual processing personal data for purposes not exceeding personal or family use, within their family or limited social circle (Regulation Art. 2(1)-(2))
• Whether it applies depends on facts outside the code; a person has to decide.

# Resume screener
Risk: low. Approved.

# AI system impact assessment: resume screener (v3, 2026-09-01)
- Intended use: rank applications for recruiter review; no automatic rejection
- Affected: applicants; groups at risk: career-gap, non-native-language applicants
- Harms: unfair exclusion, opaque ranking; societal: narrowing of hiring pools
- Mitigations: subgroup ranking audit each release; recruiter sees all applicants
- Residual impact: medium, accepted by Head of Talent (signed 2026-09-03)
- Revisit: on model, feature, or use change

Standards that recommend the same control

• AI systems should undergo a documented AI system impact assessment (ISO/IEC 42001) (ISO/IEC 42001:2023 (AIMS) · ISO/IEC 42001:2023, Clause 6 + Annex A (AI system impact assessment))

Rule id sa-pdpl-regs.impact-assessment-for-automated-decisions · review status: primary source derived