Saudi Arabia PDPL: every control, and what you already have

37 controls 158 frameworks share controls with it Saudi Arabia verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

Saudi PDPL Evidence & Implementation Kit

37 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Bahrain PDPL	13	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	13	measure it →
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)	13	measure it →
Taiwan PDPA	13	measure it →
Texas Data Privacy Act	13	measure it →
Uruguay DPL	13	measure it →
Virginia CDPA	13	measure it →
Barbados Data Protection Act 2019	9	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	9	measure it →
UK GDPR (UK General Data Protection Regulation)	9	measure it →
AICPA Privacy Management Framework (PMF)	9	measure it →
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)	8	measure it →

Every control

Code	Control	Also in
`SA-PDPL-01`	Notice and transparency requirements	0
`SA-PDPL-02`	Consent management and withdrawal	0
`SA-PDPL-03`	Lawful basis for processing	0
`SA-PDPL-04`	Purpose limitation and specification	0
`SA-PDPL-05`	Data minimization requirements	0
`SA-PDPL-06`	Right of access to personal data	0
`SA-PDPL-07`	Right to rectification of inaccurate data	0
`SA-PDPL-08`	Right to erasure and deletion	0
`SA-PDPL-09`	Right to data portability	24
`SA-PDPL-10`	Right to restrict processing	0
`SA-PDPL-11`	Right to object to processing	0
`SA-PDPL-12`	Automated decision-making protections	0
`SA-PDPL-13`	Encryption of personal data	87
`SA-PDPL-14`	Pseudonymization techniques	0
`SA-PDPL-15`	Access control for personal data	83
`SA-PDPL-16`	Data breach notification requirements	62
`SA-PDPL-17`	Security incident response procedures	62
`SA-PDPL-18`	Regular security testing and assessment	18
`SA-PDPL-19`	Data protection officer designation	46
`SA-PDPL-20`	Records of processing activities	18
`SA-PDPL-21`	Data protection impact assessments	95
`SA-PDPL-22`	Privacy by design and default	55
`SA-PDPL-23`	Data processing agreements	18
`SA-PDPL-24`	Cross-border transfer safeguards	19
`SA-PDPL-25`	Compliance monitoring and auditing	22
`SA-PDPL-26`	Training and awareness programs	0
`SA-PDPL-27`	Regulatory reporting and cooperation	0
`SA-PDPL-28`	Complaints handling and resolution	0
`SA-PDPL-29`	Enforcement and penalties awareness	0
`SAUDIPDPL-1`	Scope, Lawful Basis, Definitions	0
`SAUDIPDPL-2`	Consent, Notice, Sensitive Data	0
`SAUDIPDPL-3`	Data Subject Rights	0
`SAUDIPDPL-4`	Sensitive Data, Children, DPIA	0
`SAUDIPDPL-5`	Security of Processing	0
`SAUDIPDPL-6`	Cross-Border Transfer	0
`SAUDIPDPL-7`	DPO, Registration, Governance	0
`SAUDIPDPL-8`	Breach Notification, Sanctions, Enforcement	0

Tell me when Saudi Arabia PDPL files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Audit reports
Risk-based audit plan
Findings tracker
Audit programme
Auditor competence records
audit plan
Governance framework doc
Board charter
RACI matrix
access control matrix

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Findings not closed named by 7 frameworks
No periodic review named by 6 frameworks
no tabletop exercises named by 5 frameworks
no board reporting named by 5 frameworks
no risk assessment named by 3 frameworks
no root-cause analysis named by 3 frameworks

What this page is

A control-level reference for Saudi Arabia PDPL, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition