Register as a controller on the National Data Governance Platform
Severity HighPDPL Art. 30(4)(c)；实施细则 Art. 34；国家控制者登记册规则 Art. 2–7
Under PDPL Article 30(4)(c) and Article 34 of the Implementing Regulation the Competent Authority maintains a national register of controllers. Article 2 of the National Register Rules requires registration on the National Data Governance Platform where any of the following applies: the controller is a public entity; its main activity is based on personal data processing; it processes sensitive data; or an individual processes personal data for purposes exceeding personal or family use. Registration requires appointing a representative (for private entities, through the Platform by the authorised person), completing entity and representative details, and determining during the process whether a personal data protection officer must be appointed under Article 32 of the Implementing Regulation and the DPO Appointment Rules; where one is appointed, their details must be entered on the Platform. The Platform issues a registration certificate bearing a registration serial number, which may be made available to the public.
- Applies when
- AI companies that train models on user data, provide data analytics, or process sensitive data will almost always fall within “main activity based on personal data processing” or “processes sensitive data”.
- Evidence to retain
- · Registration certificate from the National Data Governance Platform with its serial number
- · Representative designation document and authorisation chain
- · Memo determining whether a personal data protection officer is required
- · Change log and annual review record for the registered particulars
Estimated first-time effort: 2–6 person-days (estimate, not a commitment)
Appoint a personal data protection officer and define the role
Severity High实施细则 Art. 32；数据保护官任命规则 Art. 4–8
Article 32(1) of the Implementing Regulation and Article 5 of the DPO Appointment Rules set three mandatory cases: a public entity providing services involving large-scale processing; core activities based on processing operations that by their nature require regular and systematic monitoring of data subjects; and core activities based on processing sensitive personal data. The Rules add criteria: large scale is judged on the number of data subjects, volume and type of data, geographical scope and categories of data subjects; “regular” means continuous, at set intervals or periodic, and “systematic” means carried out through technological systems, following a specific methodology, or as part of an overall strategy or plan — with examples including health and fitness data from wearables, behavioural analytics for risk assessment, location tracking, cookies and surveillance cameras. Activities are core where the controller cannot provide its products or services without processing personal data. The DPO may be an executive, an employee or an external contractor, and is responsible for acting as the direct contact point with the Competent Authority, supervising impact assessments and audit reporting, enabling data subjects to exercise their rights, notifying the Competent Authority of breaches, handling requests and complaints, monitoring and updating the records of processing activities, and handling violations and corrective actions.
- Applies when
- AI companies doing behavioural analytics, recommendation, risk scoring, wearable health data, in-vehicle sensing or video surveillance will typically fall within regular and systematic monitoring or sensitive-data core activities.
- Evidence to retain
- · Determination memo against the three cases and the large-scale / regular / systematic / core-activity criteria
- · DPO appointment document, role description and qualifications
- · Record of the DPO details entered on the National Data Governance Platform
- · DPO activity records (impact assessment oversight, breach notifications, request and complaint handling)
Estimated first-time effort: 3–8 person-days (estimate, not a commitment)
Notify the Competent Authority within 72 hours and inform affected data subjects
Severity CriticalPDPL Art. 20；实施细则 Art. 24（泄露通报）、Art. 23（安全措施）
PDPL Article 20 requires the controller to notify the Competent Authority upon becoming aware of any breach, damage or illegal access to personal data, and to notify the data subject where the incident would cause damage to their data or prejudice their rights and interests. Article 24(1) of the Implementing Regulation adds that, where the incident potentially causes harm to the personal data or to the data subject or conflicts with their rights or interests, the controller must notify the Competent Authority within no more than 72 hours of becoming aware; Article 24(2) allows supplementary filing in stages where not all required information can be provided within that window. In practice, fix the definition of “aware”, the cross-time-zone on-call and escalation path, and the notification templates in advance.
- Applies when
- All controllers in scope; processors should contractually commit to immediate escalation to the controller.
- Deadline: Within no more than 72 hours of becoming aware, to the Competent Authority.
- Evidence to retain
- · Breach response plan with the definition of “aware” and a 72-hour clock chart
- · Competent Authority notification template and submission records
- · Data subject notification text and proof of delivery
- · Post-incident review report and corrective action tracker
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
Maintain records of processing activities, flagging any transfer outside the Kingdom
Severity MediumPDPL Art. 31
PDPL Article 31 requires controllers to maintain records of personal data processing activities for the period prescribed by the Regulations, based on the nature of their activity, and to make them available whenever the Competent Authority requests. The record must contain at least the controller’s contact details, the purpose of processing, a description of the categories of data subjects, any other entity to which personal data has been or will be disclosed, whether personal data has been or will be transferred outside the Kingdom or disclosed to an entity outside it, and the expected retention period. For AI companies the “outside the Kingdom” field must reflect where training datasets, inference request logs, vector stores and model checkpoints actually reside and are accessed from, not merely the nominal contracting counterparty.
- Applies when
- All controllers in scope.
- Evidence to retain
- · Record of processing activities covering the six elements of Article 31
- · Inventory of where data is stored and accessed from (training sets, logs, vector stores, model checkpoints)
- · Retention policy and evidence of deletion at expiry
- · Procedure and history for producing the record to the Competent Authority
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
Personal data processing impact assessment for products and services
Severity HighPDPL Art. 22；实施细则 Art. 32(3)(b)
PDPL Article 22 requires the controller to conduct an impact assessment of personal data processing in relation to any product or service, based on the nature of its activity and in accordance with the Regulations. Unlike the EU DPIA, the trigger is tied to the product or service, so an AI company should reassess whenever it launches a feature, swaps models, widens data sources or changes how outputs are used, rather than treating it as a one-off. Article 32(3)(b) of the Implementing Regulation makes supervising impact assessment procedures, audit and control reporting, documenting the results and issuing recommendations an express duty of the personal data protection officer.
- Applies when
- Controllers launching or iterating any AI product or service in Saudi Arabia that processes personal data.
- Evidence to retain
- · Impact assessment reports organised by product or service
- · Trigger rules for reassessment (new feature, model swap, data source change, change of output use)
- · DPO oversight notes and recommendations on each assessment
- · Verification records that mitigation measures were implemented
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)
Organisational, administrative and technical security measures and lifelong confidentiality duty
Severity HighPDPL Art. 19、Art. 41
PDPL Article 19 requires the controller to implement all necessary organisational, administrative and technical measures to protect personal data, including during transfer, in accordance with the controls set out in the Regulations. Article 41 adds that any person engaged in processing personal data must protect its confidentiality even after their occupational or contractual relationship ends. Practically, confidentiality undertakings and access-revocation workflows for outsourced labelling teams, departing engineers and temporary contractors must be evidenced, and the duty survives termination.
- Applies when
- Controllers, processors and every person or subcontractor with access to the personal data.
- Evidence to retain
- · Security control catalogue and implementation evidence (encryption, access control, transport protection, logging)
- · Confidentiality undertakings for staff and subcontractors, with post-termination survival clauses
- · Account and access revocation workflow records
- · Periodic security assessment and remediation records
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)