Saudi PDPL Compliance Checklist: SDAIA-Ready in Nine Steps

Triage by visibility and harm: (1) register on the National Data Governance Platform if you meet the criteria, absence is trivially detectable by SDAIA; (2) publish a compliant privacy notice in Arabic (and English where relevant); (3) stand up the 72-hour breach process, the one obligation you cannot retrofit after the incident; (4) fix sensitive-data flows, because that is where criminal exposure lives; then build the inventory, DSR pipeline, and transfer paper in parallel. Document the remediation plan; SDAIA has responded better to documented programs than to silence.

SDAIA's registration rules capture controllers meeting the criteria published on the platform, public entities, controllers whose core activities involve large-scale or sensitive processing, and those SDAIA directs, with the platform also hosting DPO registration and breach filings. Registration involves describing processing activities in RoPA-like detail. Even where registration is not strictly triggered, the underlying RoPA duty applies to all controllers, so build the inventory once and reuse it for the filing.

That consent was freely given, specific to declared purposes, informed by a compliant notice, and given before processing, plus explicit form for sensitive data and parental consent mechanics for minors. Records need who consented, when, to what text, and through which mechanism, and must reflect withdrawals, which have to be as easy as giving consent. Bundled consent (one checkbox for service plus marketing) fails the specificity requirement. For flows moved to legitimate interest after the 2023 amendments, keep the balancing assessment on file instead.

DPO: where the regulations' triggers are met, public entities, controllers whose core activity is processing that requires regular and systematic monitoring at large scale, or large-scale sensitive-data processing; the DPO can be an employee or contractor and is registered with SDAIA. DPIA: before processing likely to cause high risk, profiling, large-scale sensitive data, new technologies, covering purposes, necessity, risks, and mitigations. Both artifacts are producibility items: SDAIA asks for them in inquiries, and their absence converts a technical violation into a governance one.

PDPL is the general law; sector rules add or tighten. SAMA (central bank) imposes outsourcing and data rules on banks and insurers, including localization expectations for certain systems. CST regulates telecom and cloud providers, with its Cloud Computing Regulatory Framework tiering data by sensitivity. NCA cybersecurity controls (ECC and cloud controls) apply localization to critical infrastructure and government data. Health data carries its own rules. A Saudi compliance file therefore has a PDPL core plus sector annexes; conflicts resolve toward the stricter rule in practice.