Saudi Arabia Opened a Personal Data Sandbox. Applying Is Not the Same as Passing It

Saudi Arabia is creating a controlled place for companies to discover whether privacy works before they scale a data-heavy product.

The Saudi Data and Artificial Intelligence Authority has opened the Personal Data Protection track within its Data Regulatory Sandbox.

Companies with products or services that process personal data can apply to test them under regulatory supervision against Saudi personal-data requirements.

But appearing in the sandbox process is not itself a compliance certificate.

Application, admission and graduation are different states

The sandbox follows a staged process.

Applications are first assessed for readiness and suitability.

Accepted participants then develop a testing plan, test their product under supervision, address observations and complete exit requirements.

Only after successful completion does SDAIA issue a sandbox completion certificate and digital badge and add the product to the public graduates list.

The test is about how the product handles real privacy requirements

The Personal Data Protection track assesses organisational, administrative and technical measures used to protect personal information.

Participants test how their product aligns with the Personal Data Protection Law, its Implementing Regulations and other applicable requirements.

The process is intended to identify problems while a product can still be changed rather than after it has been deployed at scale.

Saudi Arabia already has graduates from the sandbox

SDAIA's public graduates list shows several products that completed the 2025 cohort.

They include privacy technology, legal AI, healthcare software, marketing systems and an AI-enabled payment platform.

The examples show how broadly personal-data regulation can touch products that may initially look like software, healthcare, marketing or payments rather than privacy products.

One graduate processes children's biometric data

WAKI, one of the listed graduates, provides cashless payment services for family-focused institutions.

Its system can let users pay through facial biometric authentication, wristbands, cards or QR codes.

SDAIA's description specifically notes that the platform processes children's biometric data and applies access controls and deletion procedures.

That is the kind of high-sensitivity use case for which supervised privacy testing becomes particularly relevant.

The public eligibility wording is not perfectly aligned

Saudi Press Agency says applicants must be licensed private entities operating in the Kingdom and registered in the National Personal Data Protection Register.

SDAIA's detailed sandbox FAQ uses broader wording, stating that private entities within the Kingdom as well as entities outside the Kingdom processing personal data related to individuals residing in Saudi Arabia may be eligible for the Personal Data Protection track.

Arabian Current would therefore treat cross-border eligibility as something applicants should confirm directly through the National Data Governance Platform rather than relying on a shortened announcement.

The next sandbox track is about making money from data

SDAIA says a separate Data Monetization track is scheduled to open for applications in January 2027.

That programme will examine models for assessing the economic value of data and generating revenue from data products and services while testing alignment with applicable requirements.

The two tracks together show Saudi data regulation moving beyond enforcement toward supervised product development.

What Arabian Current is watching

Watch which companies enter the new cohort, which products graduate, what privacy problems emerge during testing and whether SDAIA clarifies the cross-border eligibility wording.

The useful evidence will come from the graduates list, not the applications list.