Saudi PDPL compliance software
What it is
The Personal Data Protection Law (PDPL) is Saudi Arabia's data protection law. It was issued by Royal Decree and entered into force in September 2023. A one year grace period ended in September 2024, so the law now applies in full. It sets rules for how personal data is collected, used, shared, kept and deleted. The Saudi Data and Artificial Intelligence Authority (SDAIA) oversees and enforces it. Implementing regulations set much of the detail, so track them as they are issued.
Who needs it
The PDPL applies to processing of personal data of people in the Kingdom. It also applies to processing by entities outside the Kingdom when that processing involves people in it. Organisations that collect, store or analyse that data fall in scope, whatever sector they serve. Some controllers must appoint a data protection officer when their activities trigger that duty. A controller decides why and how personal data is processed. Check your activities against the implementing regulations.
What auditors check
- A record of processing activities that lists each purpose, data category, recipient and retention period.
- A lawful basis for each processing activity, with proof of consent where consent is the basis.
- A privacy notice that explains what personal data is collected, why it is used and how people can exercise their rights.
- A process that handles data subject requests for access, correction and deletion within the time limits the law sets.
- Written agreements with each processor that set out its duties and the instructions it must follow.
- Security measures that fit the risk, such as encryption, access control and regular testing.
- An incident response plan that reports personal data breaches to SDAIA and informs affected people where the law requires.
- Checks on transfers of personal data outside the Kingdom that confirm an approved transfer basis applies.
- Privacy impact assessments for high risk processing, completed where the implementing regulations require them.
- A data protection officer appointed where the law requires one, with contact details on record.
How Oncrypt gets you ready
Oncrypt builds your Saudi PDPL readiness from the controls the law puts in front of you. Our scans check your website and its trackers for personal data collection. We also check your email and domain settings, your cloud accounts and the forms that collect personal data. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps each record ready for your next review. No body issues a PDPL certificate. Oncrypt gets you ready and keeps evidence current.
Overlap with other frameworks
Questions
Does the Saudi PDPL apply to companies outside Saudi Arabia?
It can. The law applies to processing of personal data of people in the Kingdom, including processing by entities outside it. Assess whether your activities involve people in the Kingdom. Confirm the position with your legal counsel.
Does Oncrypt make us Saudi PDPL compliant?
No. No body issues a PDPL certificate. Oncrypt does not issue one either. Oncrypt gets you ready and keeps evidence current, so you can show your controls at any time.
Who enforces the Saudi PDPL?
The Saudi Data and Artificial Intelligence Authority (SDAIA) oversees and enforces the law. Organisations report personal data breaches to SDAIA, as the law requires.
Does the one year grace period still matter?
The grace period ended in September 2024, so the law now applies in full. Review your processing now if you have not done so since the law took effect.
How does the Saudi PDPL compare with the UAE PDPL and GDPR?
All three cover lawful processing, data subject rights and breach handling. One set of controls can serve each of them, though each law has its own duties.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.