The Personal Data Protection Law has moved from awareness and grace into active enforcement. For most organizations that process personal data of people in the Kingdom, the question now is whether their controls would stand up to scrutiny. The Saudi Data and Artificial Intelligence Authority, through its data office, expects governance that is documented, running and backed by evidence.

In the early phase, many organizations treated the law as a policy task: publish a privacy notice, name a committee, run a workshop. Enforcement raises the bar. A regulator or a data subject can now ask you to show what personal data you hold, why, how you protect it and how fast you would react if it leaked.

The work is finite, and it has a natural order. The five actions below each feed the next one. The guidance is general on purpose, because your exact obligations depend on your sector, your data and any sector regulator above the PDPL. Treat it as a starting framework, not legal advice.

1. Map your personal data and build a record of processing #

Start with a structured inventory: every category of personal data you collect, the systems and third parties that hold it, where it is physically stored and how long you keep it. This becomes your record of processing activities, and almost every other PDPL obligation refers back to it.

What a useful record contains #

For each processing activity, record the purpose, the categories of data subjects and data, the recipients (including processors and cross-border transfers), the retention period and a short note on the security measures. Pay extra attention to sensitive data and to any transfer outside the Kingdom, because both carry higher expectations. Give the record an owner and update it whenever a new system, vendor or data flow appears.

2. Confirm the lawful basis and update privacy notices #

Every activity in the record needs a reason you can defend. Confirm the lawful basis for each one: the data subject's consent, performance of a contract, a legal obligation, or another permitted ground. Where you rely on consent, check that it was freely given, specific and recorded in a way you can produce later.

Make the notices match what you do #

Your privacy notices are the public version of your lawful basis, so they should describe your real practice, not a generic template. Check every point where you collect personal data (websites, apps, forms, front desks) and make sure the notice says who you are, what you collect, why, on what basis, who you share it with and how people can use their rights. A notice that contradicts your record of processing is an easy gap for anyone to spot.

3. Set up a process for data-subject requests #

The law gives individuals rights over their data, including access, correction, and deletion or withdrawal of consent in defined cases. With enforcement, these requests will come, and an organization that cannot answer them in an orderly way is exposed however good its policies look.

Design the workflow before the first request #

Set up one channel to receive requests, a way to verify the requester's identity, and an internal route that gets each request to the people who can act on it. Set service levels that let you answer within the timeframes the law expects, and log every request and outcome. The data map from step one is what makes this possible, because it tells your team where to look.

4. Prepare to detect and report breaches #

A personal data breach is now a regulatory event as well as a security one. You need a way to detect that personal data may have been exposed, a way to assess the severity and the risk to the people affected, and a tested procedure to notify the competent authority and, where required, the individuals. Under the Implementing Regulations, the authority must be notified within 72 hours of becoming aware of a breach that may harm the people concerned.

Rehearse the response #

Design the breach process before you need it. Decide who declares an incident a notifiable breach, what information must be gathered and which template you will use. Connect it to your incident response and forensics capability so containment, investigation and notification run together. A short tabletop exercise on a realistic scenario will expose the gaps far more cheaply than a real incident.

5. Train staff and govern third parties #

Most personal data is handled by ordinary staff and by vendors, not by the privacy team. Compliance holds up when staff recognize personal data, know their obligations and know how to escalate a request or a suspected breach. Role-based training, refreshed regularly in Arabic and English, is what turns the policy into daily behaviour.

Extend the controls to your processors #

Organizations that hold or process data for you carry part of your risk. Check that your contracts with them include data protection obligations, security commitments, breach notification duties and limits on onward transfers. Keep a current list of processors in your record of processing, and do proportionate due diligence before taking on a new one. You remain accountable for what they do with your data.

Where to start #

If the full programme feels large, start with the moves that cut the most risk for the least effort:

  • Make a first, even incomplete, map of your largest and most sensitive sets of personal data.
  • Find any cross-border transfers and confirm you can justify them.
  • Publish or correct the privacy notices on your busiest public channels.
  • Create one channel for data-subject requests and give it an owner.
  • Agree who would declare a notifiable breach and how you would reach the authority.

These steps will not make you fully compliant on their own, but the rest of the programme builds on them, and they give you evidence of progress while the deeper work continues.

Frequently asked #

Does PDPL apply to us if we are a small company?

The law applies to the processing of personal data of individuals in the Kingdom, not to company size. A smaller organization may have less data, but the core obligations on lawful basis, transparency, security and data-subject rights still apply. Scope your programme to the data you actually hold and document your reasoning.

What is the single most important thing to get right first?

An accurate record of processing. Answering requests, assessing a breach and justifying a transfer all depend on knowing what personal data you hold and where it lives. Start there and the rest becomes much easier.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.