Saudi Arabia's Personal Data Protection Law (PDPL) regulates how organizations collect, use, store and share personal data. It came into force in September 2023, with a one-year transition period for organizations to comply, and it is supervised by the Saudi Data & AI Authority (SDAIA). While much of the PDPL concerns legal and process matters, a large part of compliance depends on how your IT systems are designed and operated.
Key obligations with an IT impact
- Security of personal data: organizations must take appropriate organizational, administrative and technical measures to protect personal data.
- Breach notification: the Implementing Regulations require notifying SDAIA of a personal data breach within 72 hours of becoming aware of it, and informing affected individuals where the breach may harm them.
- Data subject rights: individuals can request access to, correction of and destruction of their data — which means you must be able to find it.
- Retention and destruction: personal data should be kept only as long as needed, then securely destroyed.
- Transfers outside the Kingdom: transferring personal data abroad is restricted and subject to specific conditions.
- Records of processing: organizations must keep records of their personal data processing activities.
Technical measures that help
- Know where personal data lives: map systems, file shares, databases and cloud services that hold personal data.
- Access control: least-privilege permissions, multi-factor authentication and regular access reviews.
- Encryption: encrypt laptops, backups and data in transit; manage keys properly.
- Endpoint and email security: most breaches start with a compromised device or phishing email.
- Logging and monitoring: centralized logs make it possible to detect a breach quickly — and to meet the 72-hour notification window with facts.
- Backup and recovery: protected, tested backups limit the impact of ransomware on personal data.
- Data hosting decisions: consider where cloud services store data when choosing providers.
Where to start
Start with a data map and a security gap assessment, fix the highest risks first (typically MFA, endpoint protection, encryption and backups), and put an incident response plan in place that includes the notification steps. This article is a technical overview, not legal advice — involve your legal or compliance advisor for the legal requirements.
How Thoughts House can help
We design and implement the security controls behind PDPL compliance — endpoint protection, firewalls, encryption, secure backup and monitoring — for organizations in Dammam and across Saudi Arabia.