Personal data protection (PDPL) compliance
Introduction
Bringing products, systems and processes into line with the Personal Data Protection Law, from data mapping to breach response.
The Personal Data Protection Law has been in force since 14 September 2023, and its grace period ended in September 2024. It applies to any processing of personal data in the Kingdom, and to processing abroad of data about people living in the Kingdom, and SDAIA supervises its application.
Compliance is practical work: knowing what data the company holds and why, having a lawful basis for each use, telling people how their data is used, honouring their rights, securing the data and controlling processors. Breaches must be notified to the regulator within 72 hours, and serious violations carry fines of up to SAR 5 million.
We run compliance programmes from data mapping and gap analysis to privacy notices, records of processing, impact assessments, processor agreements and breach response plans, and we train the teams who handle data every day.
How we help
What the work covers
Data mapping
Identifying what personal data is held, where, why and for how long.
Documents
Privacy notices, consents, records of processing and retention rules.
Rights & processors
Procedures for data subject requests, and agreements with processors.
Breach response
Incident plans and notification to the regulator within 72 hours.
Contact