Review Ksa Pdpl Readiness

KSA PDPL Readiness Review

When to use this

Use this skill when:

• A Saudi-established or Saudi-targeting organization needs to assess PDPL compliance
• Reviewing a commercial contract that involves processing personal data of Saudi residents
• Drafting or reviewing a data-processing agreement (DPA) for a KSA-based operation
• Preparing a Data Protection Impact Assessment (DPIA) for a high-risk processing activity
• Conducting due diligence on a KSA acquisition where data-handling practices are in scope

Pair with [[draft-privacy-policy-mena]] for consumer-facing privacy notice work, and with a UAE PDPL review where the organization operates across both GCC jurisdictions.

Regulatory Framework

Saudi Arabia's Personal Data Protection Law was issued by Royal Decree M/19 on 9 Sha'ban 1443H (corresponding to 11 March 2022). It entered into force in September 2023 with a grace period, and enforcement by SDAIA (Saudi Data & AI Authority) became active in September 2024.

Key instruments:

• PDPL (Royal Decree M/19): the primary statute
• PDPL Implementing Regulations: issued by SDAIA; provide granular requirements
• SDAIA Guidelines and Circulars: sector-specific guidance (health, financial, government)
• Cross-Border Data Transfer Framework: adequacy determinations and alternative mechanisms

SDAIA is the competent supervisory authority. Violations can result in fines of up to SAR 5,000,000 and criminal liability for intentional violations.

Review Methodology

Work through the following checklist. For each item, document the current state, any gap, and a remediation path.

1. Lawful Basis

The PDPL recognizes the following lawful bases for processing (narrower than GDPR's six):

Flag: (a) reliance on "legitimate interests" without a documented balancing test — SDAIA takes a narrow view; (b) consent obtained without a mechanism for withdrawal; (c) bundled consent (consent for multiple purposes in a single checkbox).

2. Data Subject Rights

The PDPL grants the following rights that must be operationally supported:

Operational check: does the organization have a documented process (with response SLAs) for each right? Is the request intake mechanism available in Arabic?

3. Cross-Border Data Transfers

The PDPL restricts transfer of personal data outside KSA unless one of the following applies:

• Adequacy decision: SDAIA has published a list of countries with adequate data protection (check current SDAIA registry — list subject to update)
• Controller assurances: the receiving controller provides contractual guarantees at least equivalent to the PDPL (analogous to GDPR Standard Contractual Clauses — SDAIA has issued model clauses)
• Vital interests / legal claims: transfer necessary to protect the data subject's life or to establish or defend legal claims
• Public interest: limited to government transfers

Practical implications:

• US, EU, UK, UAE: adequacy status must be verified against current SDAIA list
• Cloud service providers with servers outside KSA: ensure DPA includes SDAIA-approved transfer mechanism
• MENA multi-jurisdiction: if data flows from KSA to UAE and then to EU, each hop requires its own lawful transfer basis

4. Data Protection Officer (DPO) Appointment

DPO appointment is mandatory for:

• Organizations that process sensitive data at scale
• Organizations that process data of more than a specified threshold (see implementing regulations for current numerical threshold)
• Organizations whose core activities involve systematic monitoring of data subjects

Flag if: organization processes health, biometric, genetic, racial/ethnic, religious, or criminal data and has no designated DPO; DPO lacks adequate independence; DPO role is bundled with conflicting responsibilities (e.g., head of IT also serving as DPO).

5. Sensitive Data Handling

The PDPL defines sensitive data to include:

• Health and medical data
• Genetic and biometric data
• Racial or ethnic origin
• Religious beliefs or practices
• Criminal records or convictions
• Financial data beyond general income information
• Location data that could reveal sensitive patterns

Requirements for sensitive data: explicit consent (not just consent); higher security standards; in some categories, prohibition on processing unless strictly necessary.

6. Privacy Notices

A PDPL-compliant privacy notice must include:

• Identity and contact information of the controller
• Categories of personal data processed
• Purpose(s) of processing with lawful basis for each
• Recipients and cross-border transfer disclosures
• Retention period or criteria for determining retention
• Data subject rights and how to exercise them
• Contact details for SDAIA complaint channel

Notice must be in Arabic (or bilingual Arabic-English if serving both audiences). Plain language is required — dense legal boilerplate does not satisfy the "informed consent" standard.

7. Breach Notification

The PDPL requires notification to SDAIA within 72 hours of becoming aware of a personal data breach that is likely to result in harm to data subjects. This mirrors GDPR timing. Additionally:

• Data subjects must be notified if the breach is likely to cause serious harm
• The breach record must be maintained internally
• The notification to SDAIA must include: nature of breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed

Flag any contract or DPA that: (a) requires the processor to notify the controller in a timeframe that does not allow the controller to meet the 72-hour SDAIA window; (b) places breach notification costs entirely on the processor without indemnification alignment.

8. Records of Processing Activities (ROPA)

Organizations must maintain ROPA equivalent records documenting:

• Purposes of processing for each category
• Categories of data subjects and personal data
• Recipients including cross-border recipients
• Retention schedules
• Security measures

Flag if: no ROPA exists; ROPA is outdated and does not reflect current systems; ROPA is not accessible to SDAIA on request.

9. Data Processor Obligations

The PDPL imposes direct obligations on data processors (not just controllers), similar to GDPR. A compliant DPA between controller and processor must include:

• Processing only on documented instructions of the controller
• Confidentiality obligations on all persons authorized to process
• Implementation of appropriate technical and organizational security measures
• Notification obligations for breach
• Conditions for engaging sub-processors (controller approval; flow-down of obligations)
• Cooperation with SDAIA audits
• Deletion or return of data on termination

What to Flag

Output Format

{
  "gaps": [
    {
      "requirement": "<PDPL article or implementing reg reference>",
      "current_state": "<description>",
      "severity": "critical|high|medium|low",
      "remediation": "<action required>"
    }
  ],
  "readiness_score": 0-100,
  "critical_actions": [
    "<immediate actions required>"
  ],
  "dpo_required": true/false,
  "cross_border_transfers_identified": true/false,
  "sensitive_data_categories_present": ["health", "biometric", ...]
}

Limits and Escalation

• SDAIA guidance evolves; verify adequacy determination list against current SDAIA portal before advising on cross-border transfers
• Sector-specific rules (healthcare, financial, government) may impose stricter requirements — escalate for sector-specific advice
• Criminal liability provisions require review by a qualified Saudi lawyer
• This skill covers the PDPL framework; it does not cover the Cybercrime Law, the Cloud Computing Regulatory Framework, or sector-specific SAMA/CITC data rules, which may impose additional obligations

Related Skills

• [[draft-privacy-policy-mena]]
• [[draft-data-processing-agreement]]
• [[review-msa-deep-review]]
• [[review-ip-ownership-clarity]]
• [[review-missing-clauses]]