Reading the PDPL is one thing. Turning it into tasks that people in HR, IT and Sales will actually do is another. This checklist does the second part. It breaks the law and its Implementing Regulations into twelve areas, each with concrete items you can assign, tick off and back up with evidence.
New to the law? Start with What is PDPL Saudi Arabia? and come back. Want the reasoning behind each step? The step-by-step compliance guide walks through it. This list is general guidance, not legal advice, so confirm requirements against the official text published by SDAIA or with qualified counsel.
How to get the most out of it
- Give each section to one named owner. Privacy spans HR, IT, Sales, Finance and Customer Support, and a section with no owner tends to stay unticked.
- Tick an item only when you can point to evidence: a record, a log, a signed agreement or a report.
- Write a date and a name next to every gap.
- Run it again when you launch a service, add a vendor or change how you collect data.
The 12-area checklist
1. Scope and roles
Everything else depends on this, so settle it first.
- Confirm the PDPL applies: you process personal data of individuals in Saudi Arabia, from inside or outside the Kingdom.
- Decide whether you act as controller or processor for each activity.
- Name an accountable owner and list the departments that handle personal data.
- Note any sector regulator rules that apply alongside the PDPL.
2. Know where your personal data is
You cannot answer a request, run a breach response or fill in a RoPA without this.
- List every system, database and cloud service holding personal data, including CRM, HR, finance and support tools.
- Mark the datasets that sensitive personal data, such as health information, genetic data and biometric data used to identify individuals.
- Test that you can find one person across systems using a name, email or phone number.
- Keep scan logs and exports as evidence.
How Cyber RT Privacy helps: Data Scan searches connected databases by attribute and stores the scan history and exports.
3. Lawful basis and consent
- Record the basis for each processing purpose.
- Where you rely on consent, make it clear, specific to the purpose and given before processing starts.
- Make withdrawal easy, and act on it promptly.
- Store proof: who agreed, to what, when, through which channel and any later change.
- Review how you send marketing messages against the PDPL and its Implementing Regulations.
How Cyber RT Privacy helps: Consent Management keeps a searchable register with timestamps and metadata, and shows granted, declined and withdrawn trends.
4. Privacy notices
- Say what you collect, why, how, how long you keep it and who receives it.
- Describe the rights people have and how to use them.
- Show the notice wherever data is collected: web forms, apps, stores and HR onboarding.
How Cyber RT Privacy helps: the Reports module keeps your privacy policies in one place for everyone who handles personal data.
5. Records of Processing Activities (RoPA)
- Record each activity with purpose, data categories, individuals concerned, recipients, transfers, retention period and security measures.
- Let each department keep its own entries, with the DPO or privacy lead overseeing the whole.
- Set a review schedule so records do not go stale.
How Cyber RT Privacy helps: the RoPA module has a structured form, role-based access, edit logs and review reminders.
6. Data subject rights
Most teams find this section the busiest once the PDPL is live. Our guide to data subject access requests covers the process in more depth.
- Route web, email and in-store requests into one queue.
- Verify identity before sharing or changing data.
- Cover every right: being informed, access, a copy, correction, destruction and withdrawal of consent.
- Respond within 30 days. Use the extra 30 days only where the request needs unusual effort or the same person has sent several.
- Assign tasks to data owners and keep closure evidence.
How Cyber RT Privacy helps: DSR Management turns requests into tickets with deadline tracking, guided steps and audit-grade evidence.
7. Vendors and processors
- List every vendor that can reach personal data.
- Assess each one before onboarding.
- Put written processing terms in place and track them.
- Review vendors regularly. You stay responsible for the processors you choose.
How Cyber RT Privacy helps: Vendor Management offers assessment forms, an approvals register, agreement tracking and a view of what data each vendor touches.
8. Cross-border transfers
- Identify where personal data goes outside Saudi Arabia: cloud hosting, support teams, group companies.
- Check each transfer against the Regulation on Personal Data Transfer Outside the Kingdom.
- Document the ground and safeguards you rely on.
How Cyber RT Privacy helps: the vendor data view in Vendor Management is a useful starting point for mapping transfers.
9. Data Protection Impact Assessments
- Flag projects likely to carry high risk: large-scale processing, sensitive data, new technology.
- Complete a DPIA before launch and record the decisions.
- Revisit it when the project changes.
How Cyber RT Privacy helps: guided DPIA and PIA workflows keep the assessment and its reasoning on file.
10. Security and retention
- Limit access to personal data by role.
- Apply organisational, administrative and technical safeguards that match the risk.
- Set a retention period for each data type, and delete or destroy data when its purpose ends.
11. Breach response
The clock matters here, so work this out before you need it.
- Write an incident plan with named roles and escalation steps.
- Triage each incident and assess the risk to personal data and to individuals.
- Notify SDAIA within 72 hours of becoming aware of a breach that may cause harm or conflict with their rights or interests and tell affected individuals without undue delay.
- Record the investigation, the actions taken and why.
How Cyber RT Privacy helps: Data Breach Management takes incidents through triage, containment, investigation, remediation and closure, with an evidence repository and escalation for unresolved cases.
12. DPO, governance and evidence
- Check whether the Implementing Regulations require you to appoint a Data Protection Officer, and appoint one if they do.
- Train the staff who handle personal data.
- Give leadership a regular view of privacy status.
- Keep records ready for an audit or a regulator's request.
How Cyber RT Privacy helps: Reports provides cross-module dashboards and exportable PDF evidence packs.
Evidence to keep on hand
When someone asks how you comply, these are the documents that answer the question. If any are missing, that is your to-do list.
- RoPA and its edit history
- Consent records with dates and purposes
- Request logs showing receipt, actions and response dates
- Vendor assessments and processing agreements
- DPIA records for higher-risk projects
- Breach register with investigation notes
- Scan history showing where personal data was found
The stakes for gaps are set out in our article on penalties for PDPL non-compliance.
If you work in more than one market
The same structure carries over to Bahrain, the UAE and Oman, but each Personal Data Protection Law has its own requirements. The UAE also has separate regimes in DIFC (Data Protection Law) and ADGM (Data Protection Regulations). We cover each in later guides. Cyber RT lists support for Saudi, Bahrain, UAE and Oman PDPL from one platform.
Download the PDPL Saudi Arabia checklist
Get the full checklist as a printable file to share with your privacy, IT and legal teams. Enter your name, work email and company and we will send it over.
[Gated form: Full name, Work email, Company, Download button]
Prefer a live walkthrough? Request a demo and the Cyber RT team will show how the modules above work together.
Frequently asked questions
What is a PDPL checklist for?
It turns the law into tasks. A good one covers consent, individual requests, vendors, transfers, breach response and record keeping, so you can see what is done and what is missing.
Where should a first-time PDPL review begin?
With scope and data discovery. Once you know your role and where personal data sits, the other eleven areas are much easier to complete.
Who should own the checklist?
One named privacy owner, such as a DPO or compliance lead, should coordinate it. Each section then goes to the department that handles the data.
Is there a deadline for answering an individual's request?
Yes. Controllers must respond within 30 days, with a possible further 30 days where the request needs unusual effort or the same person sends several.
What is the rule on breach reporting?
Notify SDAIA within 72 hours of becoming aware of a breach that may cause harm, and tell affected individuals without undue delay.
Does the PDPL require a Record of Processing Activities?
Yes. Controllers are expected to keep records covering purposes, data categories, recipients and retention.
When do we need a Data Protection Officer?
It depends on your organisation and what you process. The Implementing Regulations set out the triggers, so check them and appoint one where they apply.
Does the checklist apply to a business based outside Saudi Arabia?
Yes, if it processes the personal data of individuals in the Kingdom.
How often should we repeat the review?
Whenever something changes: a new service, a new vendor, a new system or a new kind of processing. Otherwise, review it on a regular schedule your team can keep.
Where does the checklist fit with the wider PDPL guidance?
Read What is PDPL Saudi Arabia? for the background and How to comply with PDPL for the detailed steps. This checklist is the working document that sits between them.
How can Cyber RT help me complete it?
Cyber RT Privacy covers Data Scan, DSR Management, Consent Management, Vendor Management, RoPA, DPIA, Data Breach Management and Reports, so each item has a place to be managed and evidenced.
