SDAIA Begins Circulating PDPL Compliance Verification Form

SDAIA Begins Circulating PDPL Compliance Verification Form

by | Jul 15, 2026

The Saudi Data and Artificial Intelligence Authority (SDAIA) has begun circulating a Personal Data Protection Law (PDPL) Compliance Verification Form to registered controllers as the latest step towards an active-enforcement phase of PDPL (Royal Decree No. M/19, September 2021 amended by Royal Decree No. M/148, March 2023) which came into full force on 14 September 2023. The form requires organisations to produce information and supporting evidence demonstrating actual compliance with the PDPL.

Key Highlights Details
What does the form cover? The form spans the full breadth of PDPL obligations, requiring organisations to evidence:

  • Governance frameworks for data protection
  • Clear, documented legal bases for processing
  • Effective management and oversight of third parties/vendors
  • Defined data retention and destruction practices
  • Mechanisms to uphold data subject rights (access, correction, deletion, etc.)
  • Cross-border data transfer compliance
  • Incident/breach response procedures
  • Data Protection Officer (DPO) appointment, where applicable
Why it matters?
  • Completing the form requires a comprehensive internal compliance assessment
  • Non-compliance or gaps surfaced through the verification exercise may trigger enforcement action, including administrative fines of up to SAR 5 million (USD 1.3 million) and, in certain cases, criminal liability
  • SDAIA’s shift towards targeted, evidence-based verification of individual controllers already on its register

The circulation of the PDPL Compliance Verification Form marks a clear inflection point in SDAIA’s regulatory posture. The form itself effectively functions as a self-audit for organisations processing personal data in or from Saudi Arabia. Thus, organisations that have not already conducted an internal gap assessment against the PDPL’s core pillars (lawful basis, data subject rights, third-party management, retention, cross-border transfers, breach response, and DPO governance) should treat this development as the trigger to do so immediately, rather than waiting until the form is formally received. Early remediation, well-organised records, and legal input at the response-drafting stage will materially reduce exposure once SDAIA’s evaluation of the submitted forms begins.

Reach Us