PDPL compliance for Saudi companies — a practical checklist

The checklist

1. Map your data. List the personal data you collect — customers, employees, suppliers, website visitors — where it is stored, who can access it and who you share it with.

2. Confirm a lawful basis. Consent is one basis, but processing can also rest on a contract, a legal obligation or a legitimate interest in defined circumstances. Collect only what you need for a stated purpose.

3. Publish a privacy notice. Explain what you collect, why, the legal basis, how long you keep it, who receives it and how people can exercise their rights.

4. Handle requests. Individuals can ask to access, correct or destroy their data. Have a process and a deadline.

5. Contract with processors. Cloud providers, payroll bureaus, marketing agencies and IT vendors that process data for you need written terms on security, confidentiality and sub-processing.

6. Control transfers abroad. Transfers to countries SDAIA has not recognised as adequate need safeguards such as standard contractual clauses or binding corporate rules, and sometimes a risk assessment.

7. Secure the data. Apply technical and organisational measures proportionate to the risk, especially for sensitive data such as health, financial and biometric information.

8. Prepare for breaches. Have a plan to detect, contain, assess and report a breach to SDAIA within 72 hours where required.

9. Decide on a Data Protection Officer. A DPO is required in some cases; even when it is not, name someone responsible.

10. Keep records. Maintain records of processing activities and the decisions you made, so you can show compliance if asked.

Where companies usually fall short

The most common gaps are undocumented transfers to group companies or cloud services abroad, vendor contracts without data clauses, and marketing that relies on consent that was never properly obtained.