om Vision 2030 to Expo & the World Cup: The Legal Dimension of Saudi Ambition

Saudi Arabia is preparing to host two of the most significant global events in its history: Expo 2030 in Riyadh and the FIFA World Cup 2034. Naturally, public attention gravitates toward the visible: the stadiums, the hotels, the airports, the infrastructure. But beneath every one of these projects lies a layer that often stays invisible — until something goes wrong: the legal and compliance layer.

From my work in legal affairs and compliance, I've come to see legal readiness not as a finishing touch added at the end, but as the foundation that determines whether these projects are delivered on time, attract investment, and withstand international scrutiny. In this article, I outline the key legal fronts that organizations — public and private, local and foreign — should be preparing for now.

1. The scale of these events multiplies the legal risk

Let's put the numbers in context. Expo 2030 is projected to attract around 40 million visits over just six months, on a six-square-kilometre site north of Riyadh. The World Cup 2034 will be the first to feature 48 teams, spread across multiple cities including Riyadh, Jeddah, Al Khobar, NEOM, and Abha, with plans for over 230,000 hotel rooms nationwide.

Behind every one of these figures sits a legal obligation: contracts, licenses, the personal data of millions of visitors, potential disputes, and liabilities resting on multiple parties. The larger the scale, the greater the impact of any legal gap — a flaw that might be marginal in a small project becomes a crisis in one of this magnitude.

2. Personal Data Protection (PDPL) is no longer optional

Saudi Arabia's Personal Data Protection Law (PDPL) came into full force on 14 September 2024, after its grace period ended, and is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). Crucially, the law is no longer just text on paper — it has entered a phase of active enforcement, with dozens of decisions and penalties issued against non-compliant entities during its first year of enforcement.

What does this have to do with Expo and the World Cup? Everything:

• Millions of visitors means processing vast volumes of personal data — from bookings and ticketing to access systems, apps, and smart cameras.

• The law has extraterritorial reach, applying to any entity — local or foreign — that processes the data of individuals residing in Saudi Arabia. This means international partners, sponsors, and vendors fall within its scope.

• Cross-border data transfers are now governed by specific controls and safeguard requirements under SDAIA's Data Transfer Regulation.

Any technical solution or digital platform built for these events without accounting for PDPL from the design stage exposes the organizing entity to fines, liability, and reputational harm — at the most sensitive moment of all, when the world's eyes are on the Kingdom.

3. Foreign investment under a new legal framework

One of the most important developments accompanying this period is the new Investment Law, which came into effect on 7 February 2025, replacing the old Foreign Investment Law of 2000.

This is not a cosmetic change. The new law:

• Guarantees equal treatment between local and foreign investors in comparable circumstances.

• Replaces the licensing regime with a registration system, simplifying market entry.

• Provides protection against expropriation except by final judicial ruling and against fair compensation.

• Strengthens protection of intellectual property rights and trade secrets.

For foreign companies looking to participate in Expo and World Cup projects — whether in construction, technology, hospitality, or sponsorship — understanding this new framework, alongside the updated Companies Law (2023) and Civil Transactions Law (2023), is essential to entering the market with confidence and legal certainty.

4. Public-Private Partnerships (PPP) and contract risk

A significant portion of the infrastructure for these events will be delivered through Public-Private Partnership (PPP) models, governed by the Private Sector Participation (PSP) Law — the Kingdom's first comprehensive formal law of its kind.

Here, subtle legal challenges come to the fore:

• Risk allocation between the government authority, the private investor, and its financiers — especially in projects with strict timelines that allow no delay (a stadium cannot be late for kickoff).

• Intellectual property rights in innovative solutions and unsolicited proposals.

• Local content requirements and anti-monopoly provisions set out in the implementing regulations.

Any flaw in drafting these contracts or allocating responsibilities can later turn into a costly dispute, or a delay in a project that by its very nature cannot afford one.

5. Intellectual property and trademarks

With events of this global scale, IP protection becomes a genuine battleground: event logos, sponsor trademarks, broadcasting rights, and official merchandise are all high-value assets, heavily targeted by counterfeiting and infringement.

The Kingdom has taken important steps in this direction: acceding to the Madrid Protocol for the international registration of trademarks, and establishing an Intellectual Property Prosecution office that investigates and initiates criminal proceedings in infringement cases. Yet the need remains for a proactive protection strategy, particularly given the expected surge of goods and products linked to both events.

6. Artificial Intelligence and technical governance

Managing these two events will rely heavily on AI solutions — from crowd and traffic management systems, to real-time translation, to smart security and surveillance. This is where two dimensions meet: the technical and the legal.

SDAIA's controls on AI governance and ethics, together with the PDPL, define the framework within which these systems must operate. And the fundamental legal question that must be answered before launch, not after, is this: who bears responsibility when an automated system makes a wrong decision affecting an individual or entity?

Conclusion: Legal readiness is an investment, not a cost

Saudi Arabia is accelerating toward its Vision 2030 targets, and these two events are among its most prominent milestones. The lesson that repeats in every major project around the world is the same: solutions built without a sound legal foundation from the start will stumble later — and late remediation is always costlier than building it right from day one.

Legal readiness is not an obstacle to ambition; it is what protects it. The earlier organizations — public and private — embed the legal and compliance dimension into their planning, the better positioned they will be to turn these two events into a success worthy of the Kingdom's standing.

The countdown has begun. Legal readiness must begin with it.

What's your view? Which legal front do you see as most pressing in preparing for these two events? I'd be glad to read your perspectives in the comments.

Mahmoud Al-Thumali Law Firm for Legal Practice, Consultancy & Arbitration ® Keeping pace with the Kingdom's ambition, with deep-rooted expertise