A register built once
The record of processing was written for the deadline and has not tracked new products, vendors or data fields since. Auditors test it against live systems.
Privacy compliance service
Make PDPL compliance operational.
Limaz builds the data inventories, governance, rights and DPIA workflows, vendor controls, retention rules, and technical measures required to run a PDPL compliance program.
What Limaz delivers
- A data inventory with purposes, systems, sharing, and accountable owners
- Rights, consent, DPIA, and breach workflows that teams can operate
- Vendor, processor, and cross-border control requirements
- Retention, deletion, classification, and handling rules
- A prioritized technical-control implementation backlog
- Test results, evidence structure, training, and handover material
Controller and processor responsibilities
Organizations must know whether they determine purposes and means (controller) or process on behalf of another party (processor). That distinction drives contracts, inventories, and operational duties.
Banks, fintechs, healthcare providers, and employers often act as controllers for customer or employee data and as processors for partners. The operating model has to name both roles where they exist.
How Limaz builds a PDPL operating model
Inventory what you process
Record personal data, purposes, systems, sharing, and Arabic records.
Name owners
Who decides, who executes rights requests, who handles vendors, who owns incidents.
Design the workflows
Consent, access and deletion requests, DPIA, and breach paths that staff can actually run.
Connect classification
Handling rules and labeling so privacy policy matches how data moves.
Implement technical measures
Access, retention, deletion, vendor constraints, and evidence in the systems that hold the data.
Handover
Training and operating routines so the program does not die after the project.
What the PDPL requires, in plain terms
- Timeline
- The Personal Data Protection Law (PDPL) was issued by Royal Decree M/19 dated 9/2/1443H (16 September 2021) and amended by Royal Decree M/148 dated 5/9/1444H (27 March 2023). It came into force on 14 September 2023. Controllers then had a one-year corrective period, during which SDAIA imposed no penalties. That period ended on 14 September 2024. The law is now fully enforceable.
- Regulator and rulebook
- The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority. The law sits alongside the Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom, and SDAIA rules for the National Register of Controllers and for appointing data protection officers.
- Who it covers
- Every processing of personal data of individuals in the Kingdom, by any means, including processing by entities outside the Kingdom. The only carve-out is personal or family use that is never published or disclosed to others.
- Lawful basis
- Consent is the default. The law lists the exceptions, and legitimate interest needs a documented assessment and can never cover sensitive data. Consent cannot be a condition for a service unless the service depends on that processing, and people can withdraw it at any time.
- Transparency
- Publish a privacy policy that explains purpose, content, collection, storage, processing, destruction and rights. At the point of collection, tell people the legal basis, the purpose, who collects the data, who receives it, and whether it leaves the Kingdom.
- Records of processing
- Keep a written record of processing activities: controller and DPO details, purposes, data categories, data subject categories, recipients, retention periods, transfers outside the Kingdom and security measures. Keep it for the life of the processing plus five years after it ends.
- Data protection officer (DPO)
- Appointment is mandatory for a public entity that processes personal data on a large scale, for a controller whose core activities require regular, continuous monitoring of individuals, and for a controller whose core activities involve sensitive data. The DPO can be an employee or an external contractor.
- Impact assessments
- Assess any product or service offered to the public. The Implementing Regulations make a data protection impact assessment (DPIA) mandatory for sensitive data, for combining datasets from different sources, for large-scale processing of minors' data, continuous monitoring, new technology or automated decisions, and for anything likely to cause serious privacy harm.
- Sensitive and credit data
- Sensitive data covers racial or ethnic origin, religious, intellectual or political belief, security and criminal data, biometric and genetic data, health data, and data showing that a person's parents are unknown. Credit data needs explicit consent to collect, repurpose, disclose or publish, and you must tell the customer when a third party asks for it.
- Security
- Apply organisational, administrative and technical measures, including during transfer. The Implementing Regulations point controllers to the National Cybersecurity Authority (NCA) controls or recognised cybersecurity standards.
- Processors
- Choose processors that give sufficient guarantees and check them. The contract must set the purpose, data categories, duration, breach notification duty and any sub-processors. You stay accountable to the data subject.
- Retention and destruction
- Destroy personal data as soon as its purpose is met, unless you anonymise it, a law requires you to keep it, or it is needed for ongoing legal proceedings.
- Registration
- Register in the National Register of Controllers on SDAIA's National Data Governance Platform if you are a public entity, if processing personal data is your main activity, or if you process sensitive data. You name a delegate, receive a registration certificate, and renew it before expiry.
- Penalties
- Administrative violations: a warning or a fine up to SAR 5 million, which can double for repeat violations to a ceiling of SAR 10 million. Disclosing or publishing sensitive data to cause harm or for personal gain: up to two years in prison, a fine up to SAR 3 million, or both. Courts can also confiscate proceeds and order the ruling published.
Rights you must be able to fulfil, and how fast
- The clock for every request
- Answer within 30 days. You can extend by up to 30 more days when a request needs unusual effort or you receive many requests at once, but you must tell the person in advance and give the reason.
- Right to be informed
- The customer learns the legal basis and purpose before or at collection. In practice this is your privacy notice plus clear wording in onboarding screens, call scripts and branch forms.
- Right of access
- The customer can see the personal data you hold on them. You need to search core banking, CRM, card, lending, collections and archive systems, not only the mobile app.
- Right to a copy
- Provide the data in a readable, clear format, preferably a common electronic one. Remove information that identifies other people before you send it.
- Right to correction
- Correct, complete or update inaccurate data, and push the change to every system and recipient that holds a copy.
- Right to destruction
- Destroy data you no longer need. Where a law requires retention, record that basis and restrict the data until the retention period ends.
- Withdrawal of consent
- Withdrawing must be as easy as giving consent. Stop the processing without undue delay. Processing done before the withdrawal stays lawful.
- Marketing opt-out
- Marketing by personal contact needs consent when there is no prior relationship. Every message identifies the sender and offers a free, simple opt-out, and sending stops once the customer asks.
- Compensation
- Anyone harmed by a violation can claim material or moral damages before the competent court. A clean request log is your best defence.
Breach notification: the 72-hour clock
The PDPL and its Implementing Regulations set the rules. The clock starts when you become aware of the incident, not when the investigation ends.
Detect and log
Record the date and time of the incident and of its discovery. Leaks, loss, destruction and unlawful access to personal data all count.
Assess harm
Decide whether the incident causes or could cause harm to the data or to the data subject, or conflicts with their rights or interests. If it does, notification is mandatory.
Notify SDAIA within 72 hours
File through the National Data Governance Platform. Include a description of the incident, the categories and approximate number of people and records affected, the risks, the measures taken, whether data subjects were told, and contact details for the controller or DPO.
Complete the report
If some facts are missing at 72 hours, file what you have and send the rest as soon as possible, with the reason for the delay.
Tell affected people
Notify data subjects without undue delay, in simple and clear language, whenever the breach could harm them or their rights.
Document and fix
Keep copies of every notification and record the corrective measures. Run this alongside your SAMA and NCA incident reporting so one incident produces one consistent set of notices.
Cross-border transfers
The PDPL allows transfers outside the Kingdom for defined purposes: an international agreement the Kingdom is party to, the Kingdom's interests, an obligation to the data subject, or other purposes set in the regulations. Every transfer must not harm national security or the Kingdom's vital interests, must go to a destination with adequate protection, and must be limited to the minimum data needed.
The Regulation on Personal Data Transfer outside the Kingdom (version 2.0, August 2024) gives the mechanics. SDAIA publishes the list of countries and international organisations it considers adequate. Where a destination is not on that list, you rely on appropriate safeguards: SDAIA's standard contractual clauses, binding common rules for a multinational group, or a certificate from an entity SDAIA has licensed.
A written transfer risk assessment is mandatory in two cases: when you rely on those safeguards, and when you transfer sensitive data outside the Kingdom on a continuous or large-scale basis. It covers the legal basis, the scope of the transfer, the adequacy of the safeguards, data minimisation, possible harms and the controls that reduce them. If the safeguards stop working, or SDAIA finds them inadequate, you halt the transfer.
For a bank or fintech, the usual flows are cloud and SaaS platforms, card schemes and processors, group reporting, offshore support, and fraud or screening services. Each one needs a named mechanism, a signed contract and, where required, a risk assessment on file before the data moves.
What SDAIA and auditors ask to see
- The written record of processing activities, current and owned, covering every product and system
- Your registration certificate from the National Register of Controllers, with the named delegate
- The DPO appointment decision, reporting line and the assessment behind it
- The published privacy policy and the collection notices used in each channel
- Consent records that show what each customer agreed to, when and how, including withdrawals
- Legitimate interest assessments for every processing that relies on that basis
- Completed DPIAs with risks, mitigations, sign-off and follow-up actions
- The data subject request log with dates, outcomes and any extension notices
- Breach register, 72-hour notifications and records of corrective measures
- Processor contracts with the required clauses, and evidence of processor checks
- Transfer mechanisms and risk assessments for every flow outside the Kingdom
- Retention schedules and destruction evidence from the systems themselves
Common gaps in banks and fintechs
Legitimate interest overused
Teams label processing as legitimate interest without the written balancing test, or apply it to sensitive data, which the regulations forbid.
Requests handled by email
Access and correction requests land in a shared mailbox with no clock, so nobody can prove the 30-day deadline was met.
Unmapped transfers
Cloud regions, SaaS tools and group systems move data abroad with no recorded mechanism or risk assessment.
Retention on paper only
The retention policy exists, but core systems and backups keep everything forever. Auditors want destruction evidence from the systems themselves.
Fraud and AML data outside the DPIA
Fraud and AML platforms such as Naiza combine identity, transaction, device and screening signals, which is exactly the dataset matching that triggers a DPIA. Limaz documents it once, with the controls built in.
A 90-day PDPL programme
This is how Limaz runs a PDPL programme for a bank or fintech. Each phase ends with evidence you can hand to SDAIA or an internal auditor.
Days 1 to 15: scope and ownership
Confirm your controller and processor roles, registration status and DPO requirement. Name the accountable owners in business, technology, legal and risk.
Days 16 to 35: record of processing
Map each product and system: data, purpose, lawful basis, recipients, retention and transfers. Flag sensitive and credit data.
Days 36 to 50: legal basis and notices
Fix consent capture and withdrawal, write legitimate interest assessments, and align the privacy policy and channel notices with real processing.
Days 51 to 65: rights and breach workflows
Build the request workflow with the 30-day clock and the 72-hour breach runbook, then test both with a tabletop exercise.
Days 66 to 80: DPIAs, vendors and transfers
Complete the mandatory DPIAs, update processor contracts, and put a mechanism and risk assessment behind every transfer outside the Kingdom.
Days 81 to 90: controls and handover
Implement retention and destruction in the systems, assemble the evidence pack, train the teams and hand over a run calendar the DPO owns.
Further reading
The PDPL Implementing Regulations: the obligations companies miss
The PDPL sets the principles. The Implementing Regulations set the deadlines, triggers and records that SDAIA checks. This guide covers the parts companies most often get wrong.
Transferring personal data outside Saudi Arabia under the PDPL
Cloud, SaaS and group reporting all move personal data abroad. The Transfer Regulation allows it under clear conditions. This guide turns them into a decision you can document.
Questions
The Personal Data Protection Law is Saudi Arabia's primary personal-data law. Official texts and implementing regulations are published by the competent authorities, including SDAIA.
A PDPL operating model assigns data inventories, owners, request workflows, processor controls, classification rules, and technical measures to daily operations.
No. The PDPL covers any processing of personal data of individuals in the Kingdom, including processing by entities outside Saudi Arabia. Where the company is incorporated does not decide it.
No. They share themes (inventory, rights, processors, security) but they are different legal regimes.
The Personal Data Protection Law came into force on 14 September 2023. It was issued by Royal Decree M/19 in 2021 and amended by Royal Decree M/148 in March 2023. Controllers had a one-year corrective period, during which SDAIA imposed no penalties, which ended on 14 September 2024. Since then the law and its Implementing Regulations are fully enforceable.
Administrative violations carry a warning or a fine up to SAR 5 million, and the fine can double for repeat violations, to a maximum of SAR 10 million. Disclosing or publishing sensitive data with intent to harm or for personal benefit carries up to two years in prison, a fine up to SAR 3 million, or both. Courts can also confiscate proceeds and order the ruling published.
You must notify SDAIA within 72 hours of becoming aware of a breach that causes or could cause harm to personal data or to data subjects. The notice describes the incident, the people and records affected, the risks and the measures taken. If facts are missing, send them as soon as possible with reasons. Affected individuals are notified without undue delay in simple language.
The Implementing Regulations require a DPO in three cases: a public entity that processes personal data on a large scale, a controller whose core activities require regular, continuous monitoring of individuals, and a controller whose core activities involve sensitive data. The DPO can be an employee or an external contractor. SDAIA has also issued rules on the appointment itself.
Controllers must respond within 30 days. The deadline can be extended by up to 30 more days when the request needs unusual effort or many requests arrive together, provided the data subject is told in advance with the reason. The same clock covers requests to access, copy, correct or destroy personal data.
Controllers must register in the National Register of Controllers on the platform if they are a public entity, if processing personal data is their main activity, or if they process sensitive data. Private entities name a delegate who completes the registration. Registered controllers receive a certificate and renew it before it expires. The same platform is used for breach notifications.
Yes, under the PDPL and the Regulation on Personal Data Transfer outside the Kingdom. The transfer must not harm national security, must go to an adequate destination or rely on safeguards such as SDAIA's standard contractual clauses or binding common rules, and must be limited to the minimum data. A risk assessment is required when using safeguards or sending sensitive data abroad continuously or at scale.
PDPL makes consent the default basis and bars legitimate interest for sensitive data. It adds criminal penalties for disclosing sensitive data, caps fines at SAR 5 million (doubling for repeat violations) instead of a share of turnover, requires registration with SDAIA, and has its own transfer clauses and risk assessments. Both set a 72-hour breach deadline and about a month to answer requests, but PDPL allows only one 30-day extension where GDPR allows two more months.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.