Framework library · Saudi Arabia

Saudi PDPL

Personal Data Protection Law (Saudi Arabia). Published by Saudi Data & AI Authority (SDAIA), version Royal Decree M/19 (as amended by M/148). Kapālins maps it to 4 controls. 1 of 4 controls are proved by a live signal from the platform, and 3 by the assessment.

Read the source document

Controls mapped
SAPDPL-19Security of personal dataLive signal
SAPDPL-20Personal data breach notification to SDAIAAssessment
SAPDPL-29Transfer of personal data outside the KingdomAssessment
SAPDPL-CONSENTConsent and legal basis for processingAssessment

Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.

History

How Saudi PDPL got here.

  1. Adopted

    Royal Decree M/19 approved the Personal Data Protection Law. CMS Expert Guide

  2. Amended

    Royal Decree M/148 amended the PDPL and moved its effective date to 14 September 2023. CMS Expert Guide

  3. Guidance

    The PDPL Implementing Regulations and the Regulation on Personal Data Transfer were issued. CMS Expert Guide

  4. In force

    The Personal Data Protection Law came into force, with a one-year grace period. SDAIA

  5. In force

    The compliance grace period ended and the PDPL became fully enforceable. SDAIA

See this framework on your estateAll 42 frameworks