On this page
- What does a PDPL compliance checklist need to cover?
- How do you confirm PDPL scope and governance?
- What legal basis, consent and notice checks does the PDPL require?
- How should you handle PDPL data subject requests?
- What records and impact assessments does the PDPL require?
- Which security and breach controls belong on a PDPL checklist?
- How do you check vendors and cross-border transfers for the PDPL?
- How do you keep PDPL compliance audit-ready in 2026?
- How Sumrite helps
- Frequently asked questions
Delivered with a verified NCA-registered partner
Sumrite runs PDPL readiness and VAPT for Saudi organisations end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Talk to our team.
This checklist turns the law into tasks with owners and evidence. It reflects the Personal Data Protection Law and its Implementing Regulation as in force in November 2026. For background on each obligation, read our Saudi PDPL compliance guide first. If you want it as a spreadsheet with owner, evidence and status columns, ask us through the contact form below.
What does a PDPL compliance checklist need to cover?
A PDPL compliance checklist needs to cover ten areas, from scope and legal bases through records, security, breaches and transfers, and each area needs written evidence rather than a policy statement alone. The table maps each area to its main legal source.
| # | Checklist area | Main legal source | Evidence to keep |
|---|---|---|---|
| 1 | Scope and governance | PDPL Article 2; DPO and registration rules | Scope note, DPO decision, registration certificate or “not required” note |
| 2 | Legal basis and consent | PDPL Articles 5 and 6; Implementing Regulation Article 11 | Purpose register with a basis per purpose, consent logs |
| 3 | Privacy notice | PDPL Articles 12 and 13 | Published privacy policy, version history |
| 4 | Data subject rights | PDPL Articles 4 and 5 | Request log with dates and outcomes |
| 5 | Records of processing | PDPL Article 31; Implementing Regulation Article 33 | Written record, kept five years after processing ends |
| 6 | Impact assessments | PDPL Article 22; Implementing Regulation Article 25 | DPIAs for each triggered activity |
| 7 | Security safeguards | PDPL Article 19 | Penetration test reports, remediation, access reviews |
| 8 | Breach notification | Implementing Regulation Article 24 | Breach plan, tabletop record, incident log |
| 9 | Processors and vendors | PDPL and Implementing Regulation processor duties | Signed processing agreements, vendor assessments |
| 10 | Cross-border transfers | PDPL Article 29; Transfer Regulation | Transfer register, SCCs, risk assessments |
How do you confirm PDPL scope and governance?
Confirm PDPL scope by listing every system and activity that processes personal data of people in Saudi Arabia, including processing by group companies and vendors abroad, then assign a named owner, decide on a data protection officer (DPO) and decide on registration with SDAIA. Article 2 of the PDPL reaches processing outside the Kingdom of data about Saudi residents.
- Write a dated scope note listing the entities, systems and activities in scope
- Name an executive owner for PDPL compliance and a working team across legal, IT and security
- Test the DPO triggers: public entity processing at large scale, core activities involving regular and systematic monitoring, or core activities involving sensitive data
- Test the registration criteria for the SDAIA National Register of Controllers and record the result either way
- Confirm who holds power of attorney and credentials for SDAIA’s National Data Governance Platform
- Plan PDPL training for staff who handle personal data
What legal basis, consent and notice checks does the PDPL require?
The PDPL requires a lawful basis for every processing purpose, documented consent where consent is the basis, explicit consent for sensitive data, credit data and solely automated decisions, consent for marketing with an easy opt-out, and a privacy policy published before collection. Legitimate interest is available with a balancing assessment but never for sensitive data, under Article 6.
- Build a purpose register: every purpose, its lawful basis and the systems involved
- Record a legitimate interest assessment for each purpose that relies on it
- Check that no sensitive data relies on legitimate interest
- Confirm consent is specific to each purpose, logged and withdrawable
- Use explicit consent for sensitive data, credit data and solely automated decisions
- Stop SMS, WhatsApp and email marketing to any list without provable consent, and add a simple opt-out to every message
- Publish a privacy policy covering purposes, legal bases, recipients, retention and rights, and keep a version history
- Check that collection forms ask only for data each purpose needs
Marketing without consent was one of the four violation types SDAIA’s committees penalised, according to the Saudi Press Agency’s 16 January 2026 report of 48 enforcement decisions. It is also the cheapest gap to close.
How should you handle PDPL data subject requests?
Handle PDPL data subject requests through one logged workflow that verifies identity and answers within 30 days, extendable by up to 30 more days with advance notice and reasons. The rights in Articles 4 and 5 are to be informed, to access and obtain a copy in a readable format, to correction, to destruction and to withdraw consent.
- Publish one intake channel for requests and train front-line staff to route them
- Verify identity without collecting more data than necessary
- Log every request with received date, deadline, outcome and response date
- Test that you can export one person’s data from every in-scope system
- Test that destruction reaches backups, analytics tools and processors, subject to legal retention duties
- Apply the 30-day clock, and the 30-day extension only where justified
What records and impact assessments does the PDPL require?
The PDPL requires a written record of processing activities kept for as long as processing continues plus five years, and an impact assessment before high-risk processing such as sensitive data, linking datasets from different sources, continuous monitoring, new technologies or automated decisions. These two documents are the backbone of your SDAIA evidence.
Records of processing
Under PDPL Article 31 and Implementing Regulation Article 33, the record includes the controller’s contact details, the purposes, the categories of personal data and data subjects, the recipients, retention periods, transfers outside the Kingdom and, where possible, security measures, as summarised in the OneTrust DataGuidance and Clyde & Co comparison. There is no small-business exemption.
Impact assessments
The Implementing Regulation also expects you to reassess when risks to privacy emerge and to share the assessment with processors acting for you.
- Build the record from real systems, not interviews alone; see our guide to personal data discovery for the PDPL
- Include every column the PDPL lists, including transfers and retention
- Review the record at least when systems, vendors or purposes change
- List the activities that trigger an impact assessment and complete each one before processing starts
- Keep superseded versions for five years after processing ends
Which security and breach controls belong on a PDPL checklist?
A PDPL checklist needs security controls that prove Article 19’s organisational, administrative and technical measures work, and a breach process that can notify SDAIA within 72 hours of becoming aware of a breach that may cause harm, under Implementing Regulation Article 24. Missing safeguards were one of the four violation types SDAIA penalised in the year to January 2026.
Security safeguards
Entities already subject to the National Cybersecurity Authority’s controls should align PDPL security with them; our NCA ECC compliance guide explains how.
- Penetration test every portal, app and API that collects personal data: web application VAPT, API security testing and mobile app VAPT
- Assess the cloud environments that store personal data with a cloud security assessment
- Retest and close findings, and keep the retest report
- Review privileged access and remove stale accounts
- Encrypt personal data in transit and at rest where appropriate
- Log access to personal data and keep logs long enough to investigate
Breach notification
- Write a breach plan naming who starts the 72-hour clock, who assesses harm and who files on SDAIA’s platform
- Require processors to notify you of breaches without undue delay in their contracts
- Run a tabletop exercise and record the outcome
- Keep an incident log, including incidents you decided not to report and why
How do you check vendors and cross-border transfers for the PDPL?
Check vendors by signing processing agreements that bind them to the PDPL and verifying their compliance, and check transfers by confirming each one meets PDPL Article 29 and SDAIA’s Regulation on Personal Data Transfer outside the Kingdom. The controller stays responsible for its processors.
- List every processor and sub-processor that touches Saudi personal data
- Sign agreements covering instructions, security, breach notice, sub-processor approval and any foreign laws that affect the processor
- Map every transfer and disclosure outside Saudi Arabia, including support access and backups
- Use SDAIA’s Standard Contractual Clauses or binding common rules where required
- Complete a transfer risk assessment where the Transfer Regulation requires one
- Send only the minimum data each transfer needs
Our guide to PDPL cross-border data transfers covers each mechanism. For vendor reviews, our vendor risk and TPRM page explains how we test suppliers.
How do you keep PDPL compliance audit-ready in 2026?
Keep PDPL compliance audit-ready by holding a current evidence binder, reviewing the checklist at least annually and after major changes, and tracking SDAIA’s rule changes. SDAIA’s procedure gives five days to respond to a notice of alleged violation, as our guide to PDPL penalties and SDAIA enforcement explains.
- Assemble the binder. Scope note, purpose register, privacy policy versions, request log, records of processing, DPIAs, test reports, breach plan, vendor agreements and transfer documents.
- Set a review cycle. Re-run the checklist at least annually and after new systems, vendors or markets.
- Watch the draft rules. On 6 October 2026 SDAIA put draft Implementing Regulation amendments out for comment until 5 November 2026. They are proposals only; see our analysis of the draft amendments.
- Expect independent audits. In July 2026 SDAIA consulted on draft guidelines for licensing entities that audit personal data processing.
If your programme started from the GDPR, check the differences in our Saudi PDPL vs GDPR comparison.
How Sumrite helps
Sumrite runs PDPL gap assessments against this checklist, builds records of processing, fixes consent and notice gaps, rehearses breach response and performs the security testing that proves your safeguards. We deliver end to end with our verified NCA-registered partner firm and have served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our Saudi PDPL compliance page describes the engagement, and our Saudi Arabia page explains how we deliver a Sumrite VAPT report for Saudi reviews in 48 hours.
Get this checklist as a spreadsheet
Ask us for the PDPL checklist as a spreadsheet with owner, evidence and status columns, and we will scope a gap assessment around it. Book a scoping call.
Frequently asked questions
What should a PDPL compliance checklist include?
A PDPL compliance checklist should cover scope and governance, a lawful basis for every purpose, privacy notices, data subject rights, records of processing, impact assessments, security safeguards, breach notification, processor contracts and transfers outside Saudi Arabia. Each item should name the evidence a controller would show the Saudi Data & AI Authority (SDAIA) on request.
How long must PDPL records of processing be kept?
Saudi PDPL records of processing must be kept for as long as the processing continues and for five years after it ends. The record covers purposes, categories of personal data and data subjects, recipients, retention periods, transfers outside the Kingdom and, where possible, security measures.
How quickly must a Saudi business answer a PDPL data subject request?
A Saudi business must answer a PDPL data subject request within 30 days under the PDPL Implementing Regulation. The deadline can be extended by up to a further 30 days where the request needs unusual effort or several requests arrive, provided the individual is told in advance with reasons.
Does the PDPL compliance checklist need a penetration test?
The Saudi PDPL does not name penetration testing, but Article 19 requires appropriate organisational, administrative and technical measures to protect personal data. SDAIA penalised controllers for missing safeguards in the decisions reported in January 2026, so a recent penetration test of systems holding personal data is the clearest evidence for the security items on a PDPL checklist.
Is there a PDPL compliance checklist in spreadsheet form?
Sumrite provides this PDPL compliance checklist as a spreadsheet on request through its contact page, with columns for owner, evidence and status. The spreadsheet follows the same order and article references as the published checklist.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
