NCA ECC
Measure your posture against the National Cybersecurity Authority's Essential Cybersecurity Controls.
Learn moreBring your handling of personal data into line with the Kingdom's Personal Data Protection Law. We map your data, build your records of processing, close the gaps, and stand up the rights and breach processes that the law expects of controllers and processors.
The Personal Data Protection Law (PDPL) is the Kingdom of Saudi Arabia's national framework governing the processing of personal data of individuals within the Kingdom. It applies to organizations that determine the purposes and means of processing (controllers) and to those that process data on their behalf (processors), and it reaches processing carried out by entities inside the Kingdom as well as certain processing of data relating to individuals resident in the Kingdom.
The law sets expectations around having a lawful basis for processing, being transparent with individuals through clear privacy notices, honouring the rights granted to data subjects, maintaining records of processing activities, and handling personal-data breaches responsibly. For marketing, human-resources, and customer-data heavy businesses in particular, these obligations touch core day-to-day operations, so a structured compliance programme is the practical way to manage the risk and demonstrate accountability to the competent authority.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For PDPL compliance, that translates into the following steps.
Our work is anchored to recognized privacy and security frameworks so it is defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
The Personal Data Protection Law is the Kingdom of Saudi Arabia's national framework for the protection of personal data. It sets expectations around lawful basis, transparency, data-subject rights, records of processing, and the responsible handling of personal-data breaches for organizations that process the personal data of individuals in the Kingdom.
Any organization processing personal data of individuals in the Kingdom is in scope, whether it acts as a controller that decides the purposes and means of processing or as a processor handling data on a controller's behalf. We help you confirm your role and applicability during scoping and document the rationale.
Under the law, individuals are granted rights in relation to their personal data, which generally include being informed about how their data is processed, accessing their data, requesting correction of inaccurate data, and requesting deletion where appropriate. We design a process so your organization can receive, verify, and respond to these requests within the expected timeframes.
A Record of Processing Activities (RoPA) is a structured inventory of how your organization processes personal data. It captures the purposes of processing, the categories of data and data subjects, recipients, retention periods, and any transfers. It is a foundational artefact for demonstrating accountability and for answering questions from the competent authority.
Yes. Reports, privacy notices, procedures, and the readout session are available in both Arabic and English at no additional cost.
Measure your posture against the National Cybersecurity Authority's Essential Cybersecurity Controls.
Learn moreBuild the management system that underpins both information security and privacy controls.
Learn moreEquip your people to handle personal data correctly and recognize the risks that lead to breaches.
Learn moreWhat NCNICC and the PDPL require, and a plan a small company can actually run in the first hour.
Read the articleSeven parts of an AI acceptable-use policy that lets staff use ChatGPT without leaking your data.
Read the articleThe PDPL is now enforced. Five actions to take this quarter, in the right order.
Read the articleTell us about your organization and how you use personal data, and we will return a written proposal within five business days. NDA first, always.