Saudi PDPL

Saudi Personal Data Protection Law - consent, data subject rights, cross-border, controller registration.


Short name	SA PDPL
Region	Middle East & Africa
Country or scope	Saudi Arabia
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SA PDPL

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for SA PDPL.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for SA PDPL and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SA-PDPL-19` Security and Protection Measures	Controllers must take the necessary organisational, administrative and technical measures to protect personal data, including during transfer, which for software systems entails verifiable integrity of the components processing the data (PDPL Art. 19)	Scan
`SA-PDPL-20` Breach Notification Readiness	Controllers must notify SDAIA of personal data breaches that harm data or data subjects, which requires being able to pinpoint exactly which system components were compromised (PDPL Art. 20)	Scan
`SA-PDPL-8` Processor Selection Guarantees	Controllers may only engage processors that provide sufficient guarantees to protect personal data and must verify their compliance, extending to visibility over the suppliers of processing software (PDPL Art. 8)	Scan
`SA-PDPL-ROPA` Records of Processing Activities	Controllers must maintain records of their processing activities including descriptions of the processing and its means, which presumes an inventory of the software performing that processing (PDPL records-of-processing obligation and Implementing Regulation)	Scan
`SA-PDPL-PRIV` Privacy Policy Transparency	Controllers must make an accessible privacy policy available before collection begins, part of a broader documentation duty that includes identifiable, dated records of the processing environment (PDPL privacy policy/transparency obligation)	Scan
`SA-PDPL-UPD` Maintained and Current Systems	The duty to keep protection measures effective over time implies knowing the versions of deployed components so vulnerable or outdated software can be found and updated (PDPL Art. 19 ongoing security obligation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PDPL-4`	Lawfulness & Purpose Limitation
`PDPL-6`	Data Minimisation & Accuracy
`PDPL-8`	Retention Limitation
`PDPL-10`	Consent Management
`PDPL-13`	Sensitive Data Consent
`PDPL-14`	Privacy Notice Transparency
`PDPL-16`	Data Subject Rights Fulfilment
`PDPL-23`	Cross-Border Transfer Controls
`PDPL-29`	Breach Notification
`PDPL-34`	NDMO Registration

Policy templates

Written for SA PDPL:

Saudi PDPL Privacy Notice

And 22 from the standard set, adapted to SA PDPL.