# PDPL for operations managers

Source: https://goitf.com/en/cyber/guides/pdpl-explained

What the Personal Data Protection Law asks of an ordinary company in Saudi Arabia, in the order you would do the work, ending in a twenty-line checklist.

Saudi Arabia's Personal Data Protection Law came into force on 14 September 2023, and SDAIA has enforced it since the grace period ended on 14 September 2024. It applies to any organisation processing personal data in the Kingdom, whatever its size. The work is an inventory, records of processing, notices, a rights process and a 72-hour breach procedure.

## The law, the dates and the regulator

The law was issued by Royal Decree M/19 dated 9/2/1443H and amended by Royal Decree M/148 dated 5/9/1444H. It came into force on 14 September 2023, and the one-year grace period ended on 14 September 2024. SDAIA is the competent authority.

It covers any processing of personal data in the Kingdom, and processing of data about people residing in the Kingdom when that is done from outside it. SDAIA's guide says it applies irrespective of the volume or type of personal data, which puts small and medium businesses in scope. Paper records count as much as systems do.

The law has an Implementing Regulation and a separate Regulation on Personal Data Transfer outside the Kingdom. Where this guide says what the law requires, it is citing SDAIA's own published documents.

## Personal data, and the sensitive kind

Personal data is information about a person you can identify: a name, an iqama number, a phone number, a face on CCTV. Sensitive data is a listed set: racial or ethnic origin, religious, intellectual or political belief, criminal record, biometric data used for identification, genetic data, health data, and data showing unknown parentage.

Sensitive data carries three extra rules. Consent for it must be explicit. Legitimate interest cannot be the basis for processing it. And it may not be used for marketing.

At work it turns up in ordinary places. A sick note is health data. A fingerprint attendance clock processes biometric data to identify people. A pre-employment check can hold a criminal record.

## Where personal data hides in an ordinary company

Mostly in places nobody calls a system: spreadsheets, inboxes, paper books, phones and chat groups. An inventory that lists only the ERP and the HR system misses much of what the law covers.

Walk each process that touches a person, department by department, with the people who do the work. Ask what is collected, why, where it is kept, who can see it and where it goes next. Write the answers down as you go. That record is the inventory, and every later document is built from it.

- The HR spreadsheet with iqama numbers and salaries
- The visitor book at reception
- CCTV footage of the car park
- A WhatsApp group where supervisors share workers' medical notes
- The recruitment agency's inbox, and the CVs it forwards
- Supplier contacts saved on someone's personal phone
- Scanned iqama and passport copies in a shared folder

## What one line of the records looks like

One line per use of personal data. SDAIA's guide says the purpose of collection must be documented in the records of processing activities. The rest of the line is what makes the record usable when somebody asks a question about it.

The specimen below is payroll, because every employer runs it. Write one of these for each use the inventory found, in wording plain enough that the person doing the work recognises it.

| Field | Payroll, as a specimen |
| --- | --- |
| Activity | Paying monthly salaries |
| Personal data | Name, iqama number, bank account, salary, attendance |
| Whose data | Employees |
| Purpose | To pay salaries and meet the employer's obligations |
| Basis | The basis relied on, written down with the reasoning |
| Where it is kept | The payroll system and the bank's portal |
| Who can see it | HR, finance and the bank |
| Leaves the Kingdom | No, or the transfer and its safeguard if it does |
| Sensitive data | None, unless attendance is taken by fingerprint |

## Rights requests, and the log that proves you answered

People can ask to be informed about the processing, to access their data, to receive a copy in a readable format, to have it corrected, to have it destroyed, and to withdraw consent. Each request needs an owner, an identity check and a record that it was answered.

In a company that rarely receives one, the first request goes wrong because nobody knows who owns it. Name the owner in the procedure, and give reception and HR one sentence on where to send a request.

The log is short: the date received, who asked, what they asked for, how identity was checked, who answered, and the date it closed.

## Registering on the National Data Governance Platform

Registration in the National Register of Controllers is mandatory in three cases: you are a public entity, your main activity is based on processing personal data, or you process sensitive data. The registration certificate lasts up to five years.

The third test reaches further than people expect. A clinic, a pharmacy and a company that takes attendance by fingerprint all process sensitive data. Apply the tests to your inventory, and write down the answer and the reasoning so the decision can be defended later.

## The DPO: three cases, and why HR alone does not count

A data protection officer is required where a public entity processes personal data on a large scale, where core activities need regular and systematic monitoring of people, or where core activities are based on sensitive data. Processing employee data in HR is expressly not a core activity.

SDAIA's own examples of monitoring include location tracking, cookies and surveillance cameras. The test is whether the monitoring is a core activity, so a company whose business is monitoring people is a different case from an office with a camera at the door.

The DPO can be an employee or an external contractor. Whichever you choose, write the decision down with the test you applied, because the question comes back each time the business changes.

## A breach: 72 hours, and who starts the clock

Notify SDAIA within 72 hours of becoming aware of a breach, where it could harm the data or the person or conflicts with their rights or interests. The clock runs from awareness, not from the end of an investigation, so the procedure has to say who decides and how.

Name one role that judges whether the breach could cause harm, and a deputy for when that person is away. List the facts they will need: what happened, which data, whose data, and what has been done so far. Then write in the route to SDAIA and who drafts what affected people are told.

If you are also in scope for NCA's Essential Cybersecurity Controls, the same incident procedure should carry both routes, rather than two teams working from two documents.

## Sending personal data outside the Kingdom

A transfer needs an appropriate safeguard: standard contractual clauses, binding common rules, or a certificate of accreditation. In defined cases a risk assessment is needed before the transfer. Email and file storage hosted outside the Kingdom are transfers.

Most companies have more transfers than they think: the email platform, the file storage, the CRM, a supplier's support desk abroad. List each one in a transfer register with the safeguard it relies on. Whether a particular contract clause is sufficient is a question for your lawyer.

## The twenty-line checklist

Twenty lines, one per obligation or record, in the order the work is usually done. A line you cannot tick is the first item on your plan.

Tick only what you could show SDAIA today, from a document you could open.

- The legal entities and sites in scope are written down
- Every department has been walked for personal data
- Spreadsheets, inboxes, paper books and chat groups are in the inventory
- Every use of personal data has a line in the records of processing
- Every line states its purpose
- Every line states its basis, with the reasoning
- Sensitive data is listed separately, with the basis for each entry
- No sensitive data is used for marketing
- Customers, staff and visitors each have a privacy notice
- The notices match what the records say
- A rights request procedure names an owner
- Reception and HR know where to send a request
- A request log exists, even if it is empty
- Security controls are mapped to the data they protect
- A breach procedure names who judges harm, and a deputy
- The procedure has the 72-hour route to SDAIA written in
- The breach procedure has been rehearsed at least once
- Every transfer outside the Kingdom is listed with its safeguard
- The registration tests have been applied and the answer written down
- The DPO tests have been applied and the answer written down

## Short answers

### Does the PDPL apply to a small company?

Yes. SDAIA's guide says the law applies whatever the volume or type of personal data, so small and medium businesses are in scope. Size changes the amount of work, not the obligation.

### Do paper records count?

Yes. The visitor book, printed CVs and personnel files in a cabinet are all in scope, and they belong in the inventory next to the systems.

### We only hold employee data. Do we need a DPO?

Not for that reason alone. SDAIA's rules say processing employee data in HR is not a core activity. Check the three tests on this page: large-scale processing by a public entity, core activities that monitor people regularly, and core activities based on sensitive data.

### Is our cloud email a transfer?

If it is hosted outside the Kingdom, yes. It needs an appropriate safeguard and, in defined cases, a risk assessment first. List it in the transfer register with the safeguard it relies on.

### Who notifies SDAIA after a breach?

Your organisation, as the controller. The procedure should name the role that judges whether harm is possible and the person who sends the notice, so it goes within 72 hours of becoming aware.

Contact: [ops@goitf.com](mailto:ops@goitf.com) · [+966 55 682 4636](tel:+966556824636) · [WhatsApp](https://wa.me/966556824636)