The Personal Data Protection Law has been fully enforceable since 14 September 2024 and SDAIA is enforcing it. This Saudi PDPL documentation set is written from the Law and its own instruments, because a European template applied in the Kingdom is wrong in the places that get tested.
On this page:
- Where a GDPR pack goes wrong, and why Saudi PDPL documentation has to differ
- What is inside the Saudi PDPL documentation pack
- The registers in this Saudi PDPL documentation arrive already populated
- Who the Saudi PDPL documentation pack is written for
- What the Saudi PDPL documentation pack does not do
- Frequently asked questions
- Related toolkits
Where a GDPR pack goes wrong, and why Saudi PDPL documentation has to differ
The PDPL shares vocabulary with the GDPR and diverges exactly where it matters. Consent is the default basis rather than one of six. Legitimate interest is a narrow exception and is barred outright for sensitive data. Rights requests run on 30 days plus 30, not one month plus two. Controllers register on the National Data Governance Platform. Breaches go to SDAIA through that platform within 72 hours. Penalties are stated in riyals. And there is no adequacy list, so a transfer cannot be justified by pointing at one.
A relabelled GDPR pack gets every one of those wrong while looking entirely plausible, which is the problem. The privacy notice cites the wrong regulator, the lawful basis register offers six bases where the Law gives one and a short list of exceptions, and the transfer file rests on a mechanism that does not exist here.
This Saudi PDPL documentation is written against the Law as amended by Royal Decree M/148, its Implementing Regulation, the Regulation on Personal Data Transfer Outside the Kingdom, the DPO appointment rules, the National Register rules, SDAIA standard contractual clauses and BCR guidelines, and the Breach Incidents Procedural Guide – each read on SDAIA own site rather than summarised from commentary.
What is inside the Saudi PDPL documentation pack
The Saudi PDPL documentation pack is 75 editable templates – 57 Word documents and 18 Excel workbooks – across 12 sections. The legal crosswalk workbook claims 111 provisions and lists every one against the document that answers it.
- Programme foundation – scope, roles, the governance framework and the records that show accountability.
- Lawful basis and consent – consent as the default, the conditions in the Implementing Regulation, and the exceptions with the evidence each one needs.
- Privacy policy – built on the ten key elements SDAIA guideline names, with the update record, response times and complaint route it asks for.
- Records of processing – SDAIA three-tier template, with the impact-assessment fields that become mandatory when a trigger applies and the five-year retention rule.
- Data subject rights – the five rights, on the 30 plus 30 clock, with the refusal grounds stated.
- Impact assessment – the triggers and the content the Implementing Regulation specifies, rather than a European DPIA with the names changed.
- Transfers – the seven Transfer Regulation articles, the exemption cases, the safeguards, the transfer risk assessment in its four phases, revocation and onward transfers.
- Processors – the seven contract items the Implementing Regulation requires, as an actual clause set.
- Security – eight policies that turn the security duty into something testable.
- Breach – the 72-hour notification through the Platform, and the three stages of the Procedural Guide.
- DPO and registration – the appointment cases, the independence record, and the National Register entry with its five-year certificate.
- Crosswalk workbook – all 111 provisions against the document that answers each, so the coverage claim can be checked.
The registers in this Saudi PDPL documentation arrive already populated
Six transparency documents and eight security policies do the visible work, but the registers are what an inspection actually reads. Three of them ship seeded rather than empty.
The records of processing register opens in SDAIA own three-tier shape, with the impact-assessment fields already present so that a trigger cannot be missed by a column that was never added. The provisions register lists all 111 identifiers with the document that answers each, so a gap is visible as a blank cell rather than as a discovery during an audit. The transfer register carries the four phases of the risk assessment as stages, not as a single yes-or-no field.
Every Word document in the set carries a Requirements-addressed table naming the provisions it answers, and a legal basis panel that says what the Law requires. That is what makes the Saudi PDPL documentation defensible rather than merely tidy.
Who the Saudi PDPL documentation pack is written for
- Controllers and processors established in the Kingdom, at any size.
- Multinationals extending a global privacy programme into Saudi Arabia and needing the divergences stated rather than assumed.
- Data protection officers appointed under the SDAIA rules, and the teams supporting them.
- Consultancies delivering PDPL readiness work who need a defensible starting point rather than a translated European pack.
What the Saudi PDPL documentation pack does not do
It does not register you, and it does not file anything with SDAIA. It produces the documents those steps require and records the decisions behind them.
It is not legal advice, and it is not an Arabic legal translation service. The templates are in English; where a submission has to be made in Arabic, that is your step.
It does not cover the NCA cybersecurity controls. Those are a separate regime with their own evidence, and the NCA pack is built for them.
Frequently asked questions
Is this a translated GDPR pack?
No. It is written from the Law, the Implementing Regulation, the Transfer Regulation and SDAIA own rules and guidance. The places where the PDPL differs from the GDPR are the places this pack exists to get right.
Does it cover the transfer rules?
Yes – all seven articles of the Transfer Regulation, the exemption cases, the safeguards, the four-phase transfer risk assessment, revocation and onward transfers.
What formats are the files in?
Native Microsoft Word and Excel. Fully editable, no macros required, every organisation-specific value marked as a placeholder.
Do we still need a separate security programme?
Yes. The Saudi PDPL documentation includes the security policies the Law requires, but if you need a certifiable information security management system, run it alongside ISO 27001.
Related toolkits
Run it beside the NCA cybersecurity toolkit for the Kingdom security controls, the SAMA compliance toolkit if you are regulated by the central bank, and the ISO 27701 toolkit if you want a certifiable privacy management system behind it. SDAIA publishes the Law and its regulations on its own site at sdaia.gov.sa.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
The Saudi PDPL documentation pack downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open it. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.
One payment, no subscription and no annual renewal. The source files behind the Saudi PDPL documentation pack are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.
Reviews
There are no reviews yet.