PDPL

Establishing a data collection transparency procedure

Critical

High

Normal

Low

Data transfer and disclosure

Documentation of data disclosures for data stores

Critical

High

Normal

Low

Article 9.1-2: Anonymisation

1. When a Controller anonymizes the Personal Data of a Data Subject, it shall comply with the following:

Ensure that the re-identification of the Data Subject is impossible after Anonymisation.
Evaluate the impact, including the possibility of re-identifying the Data Subject, in the circumstances specified in Paragraph (1) of Article 25 of this Regulation.
Take the necessary organizational, administrative, and technical measures to avoid the risks, taking into account technological developments, methods of Anonymisation, and updates to those methods.
Evaluate the effectiveness of the applied techniques for anonymising Personal Data and make necessary adjustments to ensure that re-identification of Data Subject is impossible.

2. Anonymized data shall not be considered as Personal Data.

Related tasks

Ensuring secure anonymisation of personal data

Critical

High

Normal

Low

Management of personal data deletion capabilities

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Management of data sets

Article 4.6: Processing personal data for other purposes

When the Controller engages in additional Processing of Personal Data for a purpose other than the one for which it was initially collected for, it shall provide the Data Subject with the necessary information in accordance with the provisions of this article, before conducting the additional Processing.

Related tasks

Procedure for introducing new personal data processing purposes

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Ensuring the timeliness of privacy communication

Critical

High

Normal

Low

Process for data subjects to object processing

Critical

High

Normal

Low

Restriction of processing for personal data processed on behalf of a customer

Critical

High

Normal

Low

Article 5.1: Right of access to personal data

Without prejudice to the provisions of Articles (9) and (16) of the Law, the Data Subject has the right to access their Personal Data available with the Controller, subject to the following:

Exercising the right to access Personal Data should not negatively impact the rights of others, such as intellectual property rights or trade secrets.
Providing access to Personal Data at a request from the Data Subject, or via a channel provided by the Controller enabling Data Subject to directly access their Personal Data without the need to make a request.

Related tasks

Self-service channel for data subjects

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Ability to provide the data subject with personal data ready for transfer

Critical

High

Normal

Low

Securely delivering a copy of data subject's personal data

Critical

High

Normal

Low

Article 10: Means of communication

The Controller is required to provide appropriate means to process requests related to Data Subject rights as stipulated in the Law. The Data Subject shall have the choice to use one or many among the following means according to their preference considering options made available by the Controller:

E-mail.
Text messages.
The national address.
Communication via electronic applications.
Any other communication means provided by the Controller for this purpose.

Related tasks

Communication channels for data subject requests

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Article 8.1: Right to request destruction of personal data

The Controller shall destroy the Personal Data in any of the following cases:

Upon Data Subject's request.
If the Personal Data is no longer necessary to achieve the purpose for which it was collected.
If the Data Subject withdraws their consent, and consent was the sole legal basis for Processing.
If the Controller becomes aware that the Personal Data is being processed in a way that violates the Law.

Related tasks

Personal data destruction procedure

Critical

High

Normal

Low

Archiving and destruction processes for data sets

Critical

High

Normal

Low

Management of data sets

Article 7.3: Notification of concerned parties

Upon correcting the Personal Data, the Controller shall notify the parties to whom the Personal Data was previously disclosed without delay.

Related tasks

Personal data verification and correction procedure

Critical

High

Normal

Low

Article 33.5: Minimum requirements for personal data processing activities

The record of Personal Data Processing activities shall include, at a minimum, the following:

Controller’s name and relevant contact details.
Information about the Data Protection Officer, where required in accordance with Article (32) of this Regulation.
Purposes of Personal Data Processing.
Description of the categories of Personal Data being processed and the categories of Data Subjects.
Retention periods for each category of Personal Data, where possible.
Categories of recipients to whom the Personal Data is disclosed.
Description of Personal Data Transfers outside the Kingdom, including the legal basis for the Transfers and the recipients of the Personal Data.
Description of the procedures and the organizational, administrative, and technical measures in place that ensure the security of Personal Data, where possible.

Related tasks

Maintaining and documenting records of personal data processing activities

Critical

High

Normal

Low

Agreements and monitoring

Monitoring policy of personal data

Critical

High

Normal

Low

Legal bases for personal data transfers between different legal zones

Critical

High

Normal

Low

Data transfer and disclosure

Article 37: Filing and processing complaints

1. The Data Subject may complain to the Competent Authority within a period not exceeding (90) days from the date of the incident or the date on which the Data Subject became aware of it. The Competent Authority shall determine whether to accept the complaint or not after this period in cases where there are reasonable causes that may have prevented the Data Subject from submitting the complaint in time.

2. The Competent Authority shall receive the complaints that are submitted to it, through the designated means and according to procedures that ensure celerity and quality.

3. The Competent Authority shall keep a record of the complaints filed in a register specifically created for this purpose.

The complaint shall include the following information:

Place and time of the violation.
Name, identification, address, and telephone number of the complainant.
Information about the complained entity.
Clear and specific description of the violation, along with the evidence and the information provided with the complaint.
Any other requirements specified by the Competent Authority.

Related tasks

Procedure for managing data protection complaints

Critical

High

Normal

Low

Document complaints and their disposition

Critical

High

Normal

Low

Article 36.1-2: Auditing

1. The purpose of audit and checking is to ensure that the entity is properly protecting Personal Data through auditing and checking of carried out Personal Data Processing activities, and related controls and procedures, and identifying any gaps in compliance with the Law and its Regulations.

2. When carrying out audit or checking of Personal Data Processing activities, entities shall adhere to the following:

Provide the services independently according to professional standards.
Develop the necessary administrative and organizational procedures and controls to ensure the accuracy and integrity of their output.

Related tasks

Principles for personal data protection audits

Critical

High

Normal

Low

Privacy by design and default

Regular external auditing of privacy policies

Critical

High

Normal

Low

Executing and documenting internal audits

Critical

High

Normal

Low

Internal audit procedure -report publishing and maintenance

Critical

High

Normal

Low

Article 32.3: Responsibilities of the Data Protection Officer

The Personal Data Protection Officer is responsible for monitoring the implementation of the provisions of the Law and its Regulations, overseeing the procedures adopted by the Controller, and receiving requests related to Personal Data in accordance with the provisions of the Law and its Regulations. Specifically, their responsibilities include:

Acting as the direct point of contact with the Competent Authority and implementing its decisions and instructions regarding the application of the provisions of the Law and its Regulations.
Supervising the impact assessment procedures, audit reports, and evaluations related to Personal Data protection controls, documenting the assessment results, and issuing necessary recommendations accordingly.
Enabling the Data Subject to exercise their rights as stipulated in the Law.
Notifying the Competent Authority of Personal Data Breach incidents.
Responding to requests from Data Subjects and addressing complaints filed by them in accordance with the provisions of the Law and its Regulations
Monitoring and updating the records of Personal Data Processing activities of the Controller.
Handling the Controller’s violations related to Personal Data and taking corrective actions accordingly.

Related tasks

Appointment and responsibilities of the Personal Data Protection Officer (PDPO)

Critical

High

Normal

Low

Article 27: Processing credit data

Without prejudice to the provisions of the Credit Information Law, the Controller shall take organizational, technical, and administrative measures to protect Credit Data from any unauthorized use, misuse, access by unauthorized individuals, use for purposes other than for which it was collected, and Disclosure. The Controller shall adopt the following controls and procedures:

Adopt and implement requirements and controls issued by the Saudi Central Bank and other relevant authorities, which define the roles and responsibilities of employees of establishments providing credit information services and of the parties that have contracts with such establishments to process Credit Data.
Controller shall obtain the consent of the Data Subject and notify them of any request to disclose their Credit Data in accordance with the provisions of the Credit Information Law, while considering the provisions stated in subparagraph (d) of paragraph (1) of Article 11 of the Regulation.

Related tasks

Policy for processing credit data

Critical

High

Normal

Low

Management of credit data consent and disclosure

Critical

High

Normal

Low

Article 26: Processing health data

The Controller shall take the appropriate organizational, technical, and administrative measures to protect Health Data from any unauthorized use, misuse, use for purposes other than for which it was collected, or breach, and any procedures or means that guarantee the preservation of the privacy of its owners, and it shall, in particular, take the following controls and procedures:

Adopt and implement the requirements and controls issued by the Ministry of Health, the Saudi Health Council, the Saudi Central Bank, the Council of Health Insurance, and other related entities involved in regulating Health Services and health insurance services, that specify the tasks and responsibilities of employees of health care providers, health insurance companies, health insurance claims management companies and those which are contracted by them carrying out the Processing of Health Data.
Include the provisions of the Law and its Regulations into the internal policies of the Controller.
Distribute tasks and responsibilities among employees or workers in a way that prevents overlapping specializations and diffusion of responsibility, and taking into account different levels of access to data among employees or workers in a manner that guarantees the highest degree of the privacy of the Data Subjects.
Document all stages of Health Data Processing and provide the means to identify the person in charge for each stage.
The agreement between the Controller and the Processors - to conduct work or tasks related to Health Data Processing - shall include provisions that oblige them to abide by the procedures and measures stated in this Article.
Health Data Processing should be limited to the minimum necessary to provide healthcare services and products or health insurance programs.

Related tasks

Documentation of health data processing stages and responsibilities

Critical

High

Normal

Low

Management of Changes to Privacy Policies and Procedures

Critical

High

Normal

Low

Safeguards to protect PHI

Critical

High

Normal

Low

Access control and authentication

Access to electronic protected health information

Critical

High

Normal

Low

Security management process for ePHI

Critical

High

Normal

Low

Risk management

Personnel security policies for accessing ePHI

Critical

High

Normal

Low

Cyber security in contracts

Establishing and maintaining the comprehensive ePHI security program

Critical

High

Normal

Low

Data transfer and disclosure

Inventory and documentation of data processing agreements

Critical

High

Normal

Low

Access rights are managed by the principle of the least privilege

Critical

High

Normal

Low

Access control and authentication

Reviewing the execution of data minimisation

Critical

High

Normal

Low

Privacy by design and default

Article 28.1-2: Processing data for advertising or awareness purposes

1. Controller shall obtain the Consent from the targeted recipient before sending advertising or awareness material in case of the absence of a prior interaction between the Controller and the targeted recipient.

2. Conditions for obtaining the targeted recipient's consent for advertising or awareness materials shall be as follows:

Consent shall be given freely, and no misleading methods shall be used to obtain it.
The targeted recipient shall be enabled to specify the options related to advertising or awareness material subject to consent.
Consent of a targeted recipient consent shall be documented in a manner that can be verified in the future.

Related tasks

Guidelines for marketing and awareness communications

Critical

High

Normal

Low

Documentation of conditions of consent for relevant processing purposes

Critical

High

Normal

Low

Informing the controller of the processors of personal data

Critical

High

Normal

Low

Getting a proper consent for potential commercial utilization purposes of customer-owned data

Critical

High

Normal

Low

Limiting marketing and advertising use of personal data processed under a contract

Critical

High

Normal

Low

Article 29: Direct marketing

1. Without prejudice to the Telecommunication and Information Technology Act or any other related laws, before Processing Personal Data for Direct Marketing purposes, the Controller shall abide by to the following:

Obtain consent from Data Subject in accordance with the provisions of Article (11) of this Regulation.
Provide a mechanism that enables the Data Subject to opt out of receiving marketing materials when desired, and ensure that the procedures for opting out of receiving such materials are easy, straightforward, and at least as easy as the procedures for giving consent to receive them.

2. When sending direct marketing materials to a Data Subject, the identity of the sending entity shall be clearly stated without any anonymisation.

3. In case the Data Subject withdraws their consent for Direct Marketing, the Controller shall immediately stop sending related marketing materials without undue delay.

Related tasks

Guidelines for marketing and awareness communications

Critical

High

Normal

Low

Getting a proper consent for potential commercial utilization purposes of customer-owned data

Critical

High

Normal

Low

Limiting marketing and advertising use of personal data processed under a contract

Critical

High

Normal

Low

Article 33.1-4: Records of personal data processing activities

1. The Controller shall retain the record of Personal Data Processing activities during the period of the Processing, in addition to five years starting from the date of completion of the Personal Data Processing activity.

2. Records of Personal Data Processing activities shall be written.

3. The Controller shall ensure that the records of Personal Data Processing activities are accurate and up to date.

4. The Controller shall provide access to the records of Personal Data Processing activities to the Competent Authority upon request.

Related tasks

Maintaining and documenting records of personal data processing activities

Critical

High

Normal

Low

Records of processing activities -report publishing and maintenance

Critical

High

Normal

Low