Key takeaways
- A PDPL gap assessment compares how your organization handles personal data today with what Saudi Arabia's Personal Data Protection Law and its regulations require.
- It covers both legal and technical areas: data inventory, legal basis, privacy notices, data subject rights, transfers outside the Kingdom, security controls and breach notification.
- The output is a prioritized remediation plan, so you fix the highest-risk gaps first.
Saudi Arabia's Personal Data Protection Law (PDPL) applies to organizations that process personal data of individuals in the Kingdom. A gap assessment is the fastest way to find out where you stand and what to fix. This guide explains what to review and how to turn findings into a plan. It is practical guidance, not legal advice; confirm details with the official SDAIA documents or a legal adviser.
Step 1: Map your personal data
You cannot protect data you do not know about. Build a data inventory that answers, for each system or process:
- What personal data is collected (customers, employees, visitors, suppliers)?
- Why it is collected and on what legal basis.
- Where it is stored: on-premises servers, cloud services, email, file shares, spreadsheets.
- Who can access it, inside and outside the organization.
- How long it is kept, and how it is deleted.
- Whether it leaves the Kingdom, for example through a cloud or SaaS provider.
This inventory becomes your record of processing activities, which the regulations expect controllers to maintain.
Step 2: Review the legal and governance areas
- Legal basis: consent, contract, legal obligation or legitimate interest, documented for each purpose.
- Privacy notice: clear, available in Arabic, and describes purposes, retention and rights.
- Data subject rights: a process to handle requests to access, correct, obtain a copy of or destroy personal data within the required time.
- Transfers outside the Kingdom: identify each transfer and check it against the transfer regulation.
- Processors: contracts with vendors that process data on your behalf.
- Roles: who is responsible for data protection, and whether you need a data protection officer.
Step 3: Review the technical security controls
The PDPL requires appropriate organizational and technical measures to protect personal data. In practice, review:
- Access control: least privilege, multi-factor authentication and removal of leavers' accounts.
- Encryption of laptops, databases and backups, and of data in transit.
- Endpoint and email security, including protection against phishing and ransomware.
- Central logging so you can investigate who accessed what.
- Backups that are protected from ransomware and tested.
- Secure disposal of devices and media.
Step 4: Test your breach response
The Implementing Regulations require notifying SDAIA within 72 hours of becoming aware of a personal data breach, and informing affected individuals where the breach may harm them. Check that you have a written incident response plan, a named owner, and the logs needed to understand what happened. Run a short tabletop exercise to test it.
Step 5: Prioritize and fix
Score each gap by risk and effort. Quick wins such as MFA, an Arabic privacy notice and a rights-request process often close a large part of the risk. Larger items, such as moving data hosted abroad or adding central logging, go into a roadmap with owners and dates.
How Thoughts House can help
We support the technical side of PDPL compliance across Saudi Arabia: data mapping workshops, security control reviews, and implementation of MFA, encryption, endpoint protection, logging and backup. We work alongside your legal adviser for the legal review.
Frequently asked questions
What is a PDPL gap assessment?
A structured review that compares your current personal data practices with the requirements of the Saudi Personal Data Protection Law and its Implementing Regulations, and lists the gaps with a plan to close them.
Who supervises the PDPL in Saudi Arabia?
The Saudi Data and AI Authority (SDAIA) is the competent authority for the PDPL. Its official portal publishes the law, regulations and guidance.
How long does a PDPL gap assessment take?
For a small or mid-sized organization it usually takes a few weeks, depending on how many systems hold personal data and how well processes are documented.