PDPL and Data Residency for AI: The Four Copies of Your Data, and Which Ones Leave the Kingdom
The source records, the retrieval index, the prompt and the logs each leave the Kingdom by a different route. Why embeddings are usually personal data, why indexing is the largest transfer in the project, and twelve questions to ask.
Most discussions of the Personal Data Protection Law and AI stop at a single sentence: “keep the data in the Kingdom.” That sentence is a reasonable summary of the intent and a poor guide to implementation, because an AI system does not hold your data in one place. It holds it in at least four, and they leave the country by different routes at different times.
This article maps those four copies, explains where an AI deployment creates exposure that a conventional database does not, and gives the specific questions that turn a vendor’s residency claim into something you can verify. It is not legal advice — see the limits at the end.
What PDPL is, in the two paragraphs a technical reader needs
The Personal Data Protection Law was issued by Royal Decree M/19 in 2021, amended in 2023, with implementing regulations issued alongside. It is enforced by SDAIA. It applies to the processing of personal data of individuals in the Kingdom, and — importantly for cloud architectures — it reaches processing that happens outside Saudi Arabia when it concerns individuals inside it.
Two roles matter. The controller decides why and how personal data is processed. The processor processes it on the controller’s behalf. If you deploy an AI assistant over your customer records, you are almost certainly the controller, and your AI vendor is a processor. That distinction is not cosmetic: the controller carries the accountability, and “our vendor handles that” is not a defence available to a controller.
- 2019SDAIA establishedThe national authority for data and AI, holding the enforcement role as well as the promotional one.
- 2021PDPL issuedRoyal Decree M/19 — the Kingdom’s first comprehensive personal data protection law.
- 2023Amended, regulations issuedAmendments and implementing regulations followed, including the rules governing transfer outside the Kingdom.
- 2024–2026Enforcement maturesGuidance and enforcement practice develop; AI deployments become a visible category of processing rather than an edge case.
The obligations predate the Year of AI designation. A national AI programme changes what is possible, not what is required.
The four copies of your data that an AI system creates
A conventional application has one copy of a record and a backup. A retrieval-based AI assistant has more, and each has its own residency story. This is the part that surprises teams who have already done a cloud compliance review.
| Copy | What it contains | How it leaves the Kingdom if it does |
|---|---|---|
| The source records | Your CRM, tickets, documents — the originals | Only if the store itself is hosted abroad |
| The retrieval index | Chunks of those documents, plus vector embeddings | If the index or the embedding model is a hosted service |
| The prompt | The user’s question plus retrieved passages, assembled at answer time | Every single time, if the model is an external API |
| The logs and transcripts | Questions, answers, and often the retrieved context | If logging, analytics or observability is a third-party SaaS |
The third row is the one most reviews miss, because it exists only for a few hundred milliseconds and never appears in an architecture diagram.
The prompt is the sharpest case. To answer “what is the balance on Ms Al-Harbi’s account”, a retrieval assistant pulls the relevant record and puts it into the text sent to the model. If that model is an external API, the record has left the Kingdom — not as a database export, but as part of an ordinary request, thousands of times a day, with no export ever appearing in a log that a compliance team reviews.
Hosting location and residency are different claims
A vendor saying “we are hosted in Riyadh” has answered a question about their servers. It tells you nothing about whether producing an answer requires a call somewhere else. Both statements can be true simultaneously: hosted in Riyadh, answering via an endpoint in another jurisdiction.
Bars show how much of the residency question each statement settles. The first three are worth having and none of them is an answer.
Embeddings are personal data more often than teams assume
A vector embedding looks like a list of numbers, which invites the assumption that it is anonymous. Treat that assumption with suspicion. Embeddings are computed from the text and retain enough structure that research has repeatedly demonstrated partial reconstruction of the source. If the source chunk contained a name, a national ID or a diagnosis, the safe working position is that the embedding is personal data derived from it.
This matters because embedding is frequently the step teams outsource without noticing. Building an index means sending every document through an embedding model. If that model is a hosted API, you have just transmitted your entire corpus abroad in one bulk operation — the single largest transfer event in the whole project, and one that happens during setup, before anyone is watching production traffic.
How often each is examined in reviews we have seen, against how often it is where content actually crossed a border. The order is close to inverted.
Retention: the obligation that outlives the vendor relationship
- CollectionDo you have a lawful basisAnd is the purpose you recorded the one the assistant is actually serving.
- IndexingIs the index inside your controlAn index is a durable copy of your documents, not a cache.
- AnsweringDoes the prompt leaveAnd if it does, under which transfer condition.
- LoggingWhat is kept, and for how longTranscripts frequently contain more personal data than the source records did, because users volunteer things.
- DeletionCan you actually deleteA deletion request must reach the source, the index, the logs and any fine-tune. Most systems cover the first.
- ExitWho holds what afterwardsIndex, embeddings, transcripts and any tuned weights derived from your data.
The deletion row is where well-run projects most often fall short. A data subject exercising a deletion right expects removal, and an engineering team that deletes the source row while leaving the chunk in the retrieval index has not achieved it — the assistant will continue to answer from the deleted content.
What an on-premises architecture changes, precisely
Running the model on hardware you control does not make you compliant. Compliance is a set of obligations about lawful basis, purpose, minimisation, retention and subject rights, and none of those is satisfied by a server location. What it changes is narrower and still valuable: it collapses the transfer question.
| Obligation | Affected by where the model runs? | Notes |
|---|---|---|
| Lawful basis for processing | No | A policy and consent question, unchanged by architecture |
| Purpose limitation | No | Determined by what you use the assistant for |
| Data minimisation | Partly | You control what goes into the prompt when you control the pipeline |
| Cross-border transfer conditions | Yes — decisively | No transfer occurs, so the conditions do not arise |
| Subject access and deletion | Partly | Easier to guarantee when every copy is inside your estate |
| Breach notification | No | You still owe it; you may simply have fewer parties to ask |
One row changes decisively. Vendors selling on-premises deployment as blanket compliance are overstating it, and buyers should say so.
| System A — hosted in Riyadh | System B — on your own hardware | |
|---|---|---|
| Source records | In-Kingdom database | In-Kingdom database |
| Embedding at index time | Hosted API abroad | Runs on the same machine |
| Prompt at answer time | Sent to an external endpoint | Never leaves the network |
| Error traces | Third-party SaaS | Local log files |
| Evidence of residency | Contracts and attestations | Your own network capture |
| Where a deletion request must reach | Four parties | One estate |
Both can pass a documentation-led review. Only one of them can be checked by the team that is accountable for it.
Twelve questions that make a residency claim verifiable
- 1–3The answer pathDoes answering call an external model? Which provider and region? Can you show a network diagram or firewall rule?
- 4–6The indexWhere does embedding run? Where does the index live? Is it encrypted at rest and who holds the key?
- 7–9The logsWhat is logged, where is it stored, and for how long? Does any analytics or error-tracking SaaS see prompt content?
- 10–11DeletionOn a subject deletion request, which stores are purged, and how long does it take? Is there a report proving it?
- 12ExitOn termination, what is returned, what is destroyed, and what evidence of destruction do you receive?
The value of putting these in writing is not the answers. It is that a vendor who cannot answer question 1 in one word has told you something important before you have signed anything.
A common architecture that quietly fails
The pattern we see most often is not negligent. It is a competent team that solved the obvious problem and missed an adjacent one.
Relative frequency across deployments we have been asked to review. Directional, not a survey — and the last three are the ones the architecture diagram never shows.
An organisation can host in Riyadh, choose a Saudi model, and still be sending prompt content abroad through an error-tracking library that a developer added in the first week. The architecture diagram is not the system.
Honest limits
This is not legal advice, and we are not lawyers. PDPL and its implementing regulations have been amended since first issue and are enforced by SDAIA with published guidance that changes. Anything in this article that would change a commitment you are about to make should be checked against the current text and with qualified counsel.
We have not audited any third-party vendor’s architecture, and the frequency figures above describe deployments we were asked to look at, which is a self-selecting sample rather than a representative one.
What we state as fact is our own design, because we operate it: Elbi answers from your material on hardware you control inside the Kingdom, with no external model call in the answer path, and indexing runs in the same place. That removes the transfer question. It does not, by itself, discharge a single one of the other obligations in the table above, and we would not claim otherwise.
Common questions
No, it is conditional rather than prohibited outright. Transfer is permitted where the conditions set out in the law and its implementing regulations are met, and SDAIA enforces this. The practical consequence for an AI deployment is that residency becomes a set of conditions you must be able to evidence, which is difficult when you cannot see where an individual request was sent. This is a summary, not legal advice.
The safe working position is yes, when they are derived from text containing personal data. An embedding looks like an anonymous list of numbers, but research has repeatedly demonstrated partial reconstruction of source text from embeddings. If the source chunk contained a name, national ID or medical detail, treat the embedding as personal data derived from it and apply the same controls.
Not necessarily. Hosting describes where the application runs. It does not describe whether producing an answer requires a call to a model hosted elsewhere. A system can be hosted in Riyadh and still transmit the customer record abroad inside every prompt. Ask specifically whether answering requires an external model call, and ask for a network diagram or firewall rule as evidence.
Usually indexing, not answering. Building a retrieval index means sending every document through an embedding model. If that model is a hosted API, the entire corpus is transmitted in one bulk operation during setup — before anyone is monitoring production traffic. Compliance reviews tend to examine the stream of live requests and miss the bulk transfer that preceded it.
No. It decisively resolves one obligation — cross-border transfer, because no transfer occurs — and makes subject deletion easier to guarantee because every copy is inside your estate. Lawful basis, purpose limitation and breach notification are unchanged by where the model runs. A vendor presenting on-premises deployment as blanket compliance is overstating it.
Keep reading
PDPL and AI chatbots in Saudi Arabia
An assistant that talks to customers is a personal data processing activity whether anyone described it that way in the project plan or not. Most of the work is design decisions taken early, cheaply, before anything is built.
Read Article
HUMAIN, ALLaM and the sovereign AI stack
A Saudi model served over a foreign cloud is still a foreign network call. Here is what HUMAIN provides, where ALLaM actually runs, and the six questions that separate a real residency claim from a hosting address.
Read Article
How to train an AI chatbot on your own data
Almost nobody who says "train it on our data" wants training. They want the assistant to answer from their documents and be right. Those are different engineering problems, and only one of them is the one to solve.
Read Article