The Personal Data Protection Law is a privacy law, but most of what it demands in practice lands on the security team. This checklist turns the legal obligations into work you can plan and evidence.
Saudi Arabia's Personal Data Protection Law (PDPL) came into force on 14 September 2023, and organisations were given a one-year grace period to comply, which ended on 14 September 2024. The Saudi Data and AI Authority (SDAIA) oversees it, supported by Implementing Regulations and a separate regulation on transferring personal data outside the Kingdom.
The law applies to processing of personal data in the Kingdom, and to processing outside it that relates to people living in Saudi Arabia. If you hold data about customers, patients, employees or website visitors, it applies to you.
What follows is not legal advice, and you should work with counsel on interpretation. It is the checklist we use when helping organisations translate PDPL into controls that hold up when SDAIA, a customer or an auditor asks for proof.
1. Know what personal data you hold
- Build a data map: which systems hold personal data, what categories, about whom, and where it flows, including to suppliers.
- Keep a record of processing activities describing the purpose, legal basis, retention period and recipients for each activity.
- Flag sensitive data separately. Health, genetic, credit, biometric data and data revealing religious or political beliefs carry stricter rules.
Everything else on this list depends on the map. You cannot protect, minimise or delete data you have not found.
2. Collect only what you need, and keep it only as long as you need it
- Confirm a lawful basis and a specific purpose for each processing activity.
- Remove fields from forms and systems that collect data you never use.
- Set retention periods, then make deletion happen through scheduled jobs or documented procedures rather than good intentions.
3. Put appropriate security measures in place
The law requires organisational, administrative and technical measures that protect personal data from unauthorised access, disclosure, alteration and destruction. In practice that means:
- Access control. Role-based access, least privilege, multi-factor authentication for systems holding personal data, and regular access reviews.
- Encryption. In transit everywhere, and at rest for databases, backups and laptops that hold personal data.
- Logging and monitoring. Record who accessed personal data and alert on unusual volumes or out-of-hours access.
- Data loss prevention. Controls on email, web uploads and removable media for sensitive categories.
- Secure development. Privacy and security requirements in new projects, with test environments that do not use real customer data.
- Backups that are protected, tested and themselves covered by retention rules.
If you already follow the NCA Essential Cybersecurity Controls or ISO 27001, much of this exists. The PDPL work is mapping those controls to personal data specifically and filling the gaps.
4. Control your processors
- List every supplier that processes personal data on your behalf: cloud platforms, payroll, CRM, call centres, marketing tools.
- Put data processing terms in each contract covering purpose, security, confidentiality, sub-processors and deletion at the end of the contract.
- Assess suppliers before onboarding and periodically after, scaled to the sensitivity of the data they hold.
5. Check your cross-border transfers
Transfers of personal data outside the Kingdom are allowed only in defined circumstances, under the conditions set out in the transfer regulation. Identify every transfer, including the less obvious ones such as a SaaS platform hosted abroad or a support team in another country with remote access. For each, document the basis for the transfer and the safeguards in place, and consider whether an in-Kingdom option is now available.
6. Prepare for a breach before it happens
Under the Implementing Regulations, a personal data breach must be reported to SDAIA within 72 hours of becoming aware of it, and affected individuals must be told without undue delay where the breach could cause them harm. Seventy-two hours disappears quickly in a real incident, so:
- Add personal data breach steps to your incident response plan, with clear criteria for when the notification clock starts.
- Name who decides on notification, who drafts it and who submits it.
- Prepare templates for the regulator and for individuals.
- Rehearse it. A tabletop exercise that includes legal, communications and the data owner will expose gaps that a document review never will.
7. Handle data subject rights properly
Individuals have rights including being informed, accessing their data, obtaining a copy, having it corrected and having it destroyed. Set up a single channel for requests, verify the requester's identity, log every request and response, and make sure your systems can actually find all of one person's data. That last point is where many organisations discover their data map was incomplete.
8. Be transparent
- Publish a clear privacy notice covering what you collect, why, how long you keep it, who you share it with and how people can exercise their rights.
- Make sure the notice matches reality. An inaccurate privacy notice is a finding in its own right.
9. Assign responsibility
Some organisations must appoint a personal data protection officer, including public entities and those whose core activities involve large-scale processing, regular monitoring of individuals or sensitive data. Even if you are not required to, someone needs to own the programme, with a clear line to senior management.
10. Train people and keep evidence
- Train staff who handle personal data on what PDPL means for their daily work, not just its articles.
- Keep dated evidence: approved policies, the processing record, supplier assessments, access reviews, training completion and incident exercises.
The cost of getting it wrong
PDPL allows for warnings and significant fines, which can reach SAR 5 million for many violations and double for repeat offences, and unlawful disclosure of sensitive data can carry criminal penalties. The bigger cost is usually trust. Customers, patients and partners in the Kingdom increasingly ask how their data is protected before they sign.
Most of this checklist is ordinary good security applied with a personal data lens. If you want to see how your current controls measure up, our free maturity assessment is a quick place to start.