PDPL compliance comes down to a handful of habits. PDPL compliance requires clear accountability, lawful processing, effective security controls and ongoing monitoring. Know what personal data you hold. Have a valid basis and clear notices for using it. Answer individuals within 30 days. Control your vendors and transfers. Assess risky projects. Report qualifying breaches to SDAIA within 72 hours. And keep proof of all of it.
This guide turns those habits into ten steps. Each one says what to do and where Cyber RT Privacy fits. If the law is new to you, read What is PDPL Saudi Arabia? first. If you would rather work from a list, use the PDPL Saudi Arabia checklist alongside this guide.
Four facts to have in your head
- Regulator: the Saudi Data and AI Authority (SDAIA).
- Timing: in force since 14 September 2023, and the one-year transition ended on 14 September 2024.
- Reach: organisations in Saudi Arabia, and organisations abroad that process the personal data of individuals in the Kingdom.
- Stakes: most violations can bring a warning or a fine of up to SAR 5 million, with heavier exposure for sensitive data disclosure and repeat violations. See penalties for PDPL non-compliance.
Step 1: Settle your role and name an owner
Work out whether you are a controller, a processor or both for each activity, then pick one person to be accountable. List the departments that touch personal data: HR, IT, Sales, Finance and Customer Support are the usual ones. At this stage, also check whether the Implementing Regulations require you to appoint a Data Protection Officer.
Step 2: Find your personal data
Most delays in PDPL work trace back to not knowing where the data is. List every database, application and cloud service that stores personal data, and mark where sensitive data sits, such as health, biometric, genetic, biometric or location data. Then test whether you can search for one person across all of it using a name, email or phone number.
How Cyber RT Privacy helps: Data Scan connects to sources such as Oracle, SQL Server and PostgreSQL, runs attribute-level scans and keeps a full scan history as evidence.
Step 3: Record your processing activities
- For each activity, note the purpose, data categories, individuals concerned, recipients, transfers, retention period and security measures.
- Let each department own its entries, with the DPO or privacy lead overseeing the full record.
- Set review reminders so nothing goes stale.
How Cyber RT Privacy helps: the RoPA module has a structured form, role-based access, edit logs and review reminders.
Step 4: Choose a lawful basis and fix consent
Consent is the main basis for processing, with limited alternatives in the law and regulations, so record the basis for each purpose. Where you use consent, make it clear, specific and easy to withdraw, and keep proof of who agreed, to what, when and through which channel. Check your marketing messages against the PDPL and its Implementing Regulations while you are at it.
How Cyber RT Privacy helps: Consent Management holds a searchable register with timestamps and metadata, and shows granted, declined and withdrawn trends.
Step 5: Update your privacy notices
People should be able to see what you collect, why, how, how long you keep it, who receives it and what rights they have. Put the notice wherever data is collected: websites, apps, stores and HR onboarding.
How Cyber RT Privacy helps: the Reports module keeps your privacy policies in one place for every stakeholder.
Step 6: Build a process for individual requests
The PDPL gives people the right to be informed, to access their data, to obtain a copy, to request correction, to request destruction and to withdraw consent. Our guide to data subject access requests covers the detail. In outline:
- Send web, email and in-store requests into one queue.
- Verify identity before releasing or changing data.
- Respond within 30 days. You get a further 30 days only where the request needs unusual effort or the same person has sent several.
- Keep closure evidence for every request.
How Cyber RT Privacy helps: DSR Management turns requests into tickets, assigns tasks to data owners, tracks deadlines and guides each request from intake to closure.
Step 7: Control vendors and transfers abroad
List every vendor with access to personal data, assess each one before onboarding and put written processing terms in place. Then identify any data that leaves Saudi Arabia and check it against the Regulation on Personal Data Transfer Outside the Kingdom. You remain responsible for your processors, so this step is worth doing slowly.
How Cyber RT helps: Vendor Management provides assessment forms, an approvals register, agreement tracking and a view of what data each vendor touches.
Step 8: Assess higher-risk projects with a DPIA
Flag projects involving large-scale processing, sensitive data or new technology. Complete a Data Protection Impact Assessment before launch, record the risks you found and what you decided, and revisit it when the project changes.
How Cyber RT helps: guided DPIA and PIA workflows keep the assessment and its reasoning on file.
Step 9: Get ready for a breach
- Write an incident plan with named roles and escalation steps.
- Triage each incident and assess the risk to personal data and individuals.
- Notify SDAIA within 72 hours of becoming aware of a breach that may cause harm, and inform affected individuals without undue delay.
- Record the investigation, the actions and the reasoning.
How Cyber RT helps: Data Breach Management guides incidents through triage, containment, investigation, remediation and closure, with an evidence repository and escalation for unresolved cases.
Step 10: Secure data, train people and keep evidence
Limit access by role, apply safeguards that match the risk, set retention periods and delete or destroy data when its purpose ends. Train the people who handle personal data, and give leadership a regular view of where you stand.
How Cyber RT helps: Reports offers cross-module dashboards and exportable PDF evidence packs for management, auditors and regulators.
All ten steps in one table
| Step | Main action | Cyber RT module |
| 1 | Define roles and accountability | Governance and access control |
| 2 | Find personal data | Data Scan |
| 3 | Record processing | RoPA |
| 4 | Fix consent | Consent Management |
| 5 | Prepare and publish privacy notices | Reports (policies) |
| 6 | Handle requests | DSR Management |
| 7 | Control vendors and transfers | Vendor Management |
| 8 | Assess privacy risks | DPIA / PIA |
| 9 | Prepare for breaches | Data Breach Management |
| 10 | Apply safeguards, manage retention, train staff, monitor compliance and keep evidence | Reports |
If you operate in more than one market
The steps carry over, but each law has its own requirements. This series follows the Saudi Arabia PDPL, Bahrain PDPL, UAE Federal PDPL, Oman PDPL, DIFC Data Protection Law and ADGM Data Protection Regulations. This guide covers Saudi Arabia only. Cyber RT lists support for Saudi, Bahrain, UAE and Oman PDPL from one platform.
To see how the pieces fit together, watch the demo or request a session with the Cyber RT team.
Frequently asked questions
How do I start complying with the PDPL?
Settle whether you are a controller or a processor, name an accountable owner and find out where personal data sits across your systems and vendors. Everything else builds on that.
Who has to comply?
Organisations in Saudi Arabia that process personal data, and organisations outside the Kingdom that process the personal data of individuals in Saudi Arabia. Purely personal or family use is excluded.
Which documents should we have in place?
At minimum: a Record of Processing Activities, privacy notices, consent records, vendor assessments and agreements, DPIAs for higher-risk projects, a breach plan and request logs.
What happens if we miss the 30-day deadline for a request?
The law sets 30 days, with a limited extension of 30 more. Missing it is a compliance gap, so track every request against its deadline from the day it arrives.
When must we tell SDAIA about a breach?
Within 72 hours of becoming aware of a breach that may cause harm. Affected individuals should be told without undue delay.
Do we need to appoint a Data Protection Officer?
It depends on your organisation and what you process. The Implementing Regulations set out when one is required, so check those triggers.
Can we keep using consent for everything?
Consent is the main basis, but the law and Implementing Regulations allow other bases in limited cases. Decide the basis for each purpose separately.
Can we send personal data to a cloud provider abroad?
Only in the situations and on the conditions set out in the Transfer Regulations. List each transfer and check it against that regulation.
Where can I find a task list to work through?
Use our PDPL Saudi Arabia checklist, which breaks the work into twelve areas.
What is the risk of not complying?
Most violations can bring a warning or a fine of up to SAR 5 million, and sensitive data disclosure can carry prison time. The details are in penalties for PDPL non-compliance.
How does Cyber RT help?
Cyber RT Privacy brings Data Scan, DSR Management, Consent Management, Vendor Management, RoPA, DPIA, Data Breach Management and Reports into one platform, with an audit trail for every action.
Related reading
- What is PDPL Saudi Arabia? A beginner's guide
- PDPL Saudi Arabia checklist
- Penalties for PDPL non-compliance
This guide is general information, not legal advice. Check the official PDPL text and regulations published by SDAIA, or speak to qualified counsel, for your situation.
