Personal Data Protection Law (Saudi Arabia)
Requirement

Article 3.1: Procedure upon receipt of request from the Data Subject

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. The Controller shall, upon receiving a request from the Data Subject regarding their rights as stipulated in the Law, do the following:

  1. Act on the request of the Data Subject for exercising their rights under the Law within a period not exceeding (30) days and without delay. This period may be extended in case the implementation requires disproportionate effort, or if the Controller receives multiple requests from the data subject, provided that the extension does not exceed an additional (30) days and the Data Subject is notified in advance of the extension with the reasons for the delay.
  2. Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising rights.
  3. Take appropriate measures to verify the identity of the requester before executing the request in accordance with relevant legal requirements.
  4. Take the necessary measures to document and keep record of all submitted, including oral requests.

Fulfill this requirement by completing the tasks below ->
Personal Data Protection Law (Saudi Arabia)
Article 3.1: Procedure upon receipt of request from the Data Subject
This requirement is part of the framework:  
Personal Data Protection Law (Saudi Arabia)

Other requirements of the framework

49438
Article 24.1-2: Notification of personal data breach
49437
Article 24.3-4: Reporting obligations
49439
Article 3.1: Procedure upon receipt of request from the Data Subject
49440
Article 3.3: Exercising of rights by a legal guardian
49441
Article 3.2: Grounds for refusal
Best practices
How to implement:
Article 3.1: Procedure upon receipt of request from the Data Subject
This policy on
Article 3.1: Procedure upon receipt of request from the Data Subject
provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. The Controller shall, upon receiving a request from the Data Subject regarding their rights as stipulated in the Law, do the following:

  1. Act on the request of the Data Subject for exercising their rights under the Law within a period not exceeding (30) days and without delay. This period may be extended in case the implementation requires disproportionate effort, or if the Controller receives multiple requests from the data subject, provided that the extension does not exceed an additional (30) days and the Data Subject is notified in advance of the extension with the reasons for the delay.
  2. Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising rights.
  3. Take appropriate measures to verify the identity of the requester before executing the request in accordance with relevant legal requirements.
  4. Take the necessary measures to document and keep record of all submitted, including oral requests.

Read below what concrete actions you can take to improve this ->
Article 3.1: Procedure upon receipt of request from the Data Subject
Frameworks that include requirements for this topic:
No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to
Article 3.1: Procedure upon receipt of request from the Data Subject
Task name
Priority
Task completes
Complete these tasks to increase your compliance in this policy.
Critical
31 requirements
No other tasks found.
Complete these tasks in Cyberday ISMS ->

How to comply with this requirement

In Cyberday, requirements and controls are mapped to universal tasks. Each requirement is fulfilled with one or multiple tasks.

Here's a list of tasks that help you comply with the requirement
Article 3.1: Procedure upon receipt of request from the Data Subject
of the framework  
Personal Data Protection Law (Saudi Arabia)
Task name
Priority
Task completes
Complete these tasks to increase your compliance in this policy.
Critical
31 requirements
Documentation of data sets for data stores
Critical
High
Normal
Low
86
requirements
Management of data sets
Management of data sets

Documentation of data sets for data stores

This task helps you comply with the following requirements

5. Principles relating to processing of personal dataGDPR
6. Lawfulness of processingGDPR
8.1.1: Inventory of assetsISO 27001
18.1.3: Protection of recordsISO 27001
13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuusTiHL
Publication and maintenance of privacy notice reports
Critical
High
Normal
Low
1
requirements
Privacy
Informing and data subject requests

Publication and maintenance of privacy notice reports

This task helps you comply with the following requirements

Article 3.1: Procedure upon receipt of request from the Data SubjectPDPL
Documentation of personal data processing purposes
Critical
High
Normal
Low
2
requirements
Privacy
Informing and data subject requests

Documentation of personal data processing purposes

This task helps you comply with the following requirements

Article 4.1-4: Right to be informed about the collection of personal dataPDPL
Article 3.1: Procedure upon receipt of request from the Data SubjectPDPL
Supporting data subject requests with administrative and technical measures
Critical
High
Normal
Low
1
requirements
Privacy
Informing and data subject requests

Supporting data subject requests with administrative and technical measures

This task helps you comply with the following requirements

Article 3.1: Procedure upon receipt of request from the Data SubjectPDPL
Process for receiving and handling data subject requests
Critical
High
Normal
Low
32
requirements
Privacy
Informing and data subject requests

Process for receiving and handling data subject requests

This task helps you comply with the following requirements

15. Right of access by the data subjectGDPR
16. Right to rectificationGDPR
18. Right to restriction of processingGDPR
19. Notification obligation regarding rectification or erasure of personal data or restriction of processingGDPR
21. Right to objectGDPR
Identification of the rights available to the data subject
Critical
High
Normal
Low
6
requirements
Privacy
Informing and data subject requests

Identification of the rights available to the data subject

This task helps you comply with the following requirements

TSU-19.1: Rekisteröidyn oikeudet - Rekisteröidyn käytettävissä olevien oikeuksien tunnistaminenJulkri
P5.1: Granting access to stored personal dataSOC 2
§ 19: Behandling av personopplysningerNIS2 NO
Article 7.1: Right to request correction of personal dataPDPL
Article 3.1: Procedure upon receipt of request from the Data SubjectPDPL
Ensuring the timeliness of privacy communication
Critical
High
Normal
Low
10
requirements
Privacy
Informing and data subject requests

Ensuring the timeliness of privacy communication

This task helps you comply with the following requirements

12. Transparent information, communication and modalities for the exercise of the rights of the data subjectGDPR
18.1.4: Privacy and protection of personally identifiable informationISO 27001
18.2.2: Compliance with security policies and standardsISO 27001
A.7.3.2: Determining information for PII principalsISO 27701
TSU-19.2: Rekisteröidyn oikeudet - Läpinäkyvä informointiJulkri
Complete these tasks in Cyberday ISMS ->

The ISMS component hierachy

When building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.

Framework

Sets the overall compliance standard or regulation your organization needs to follow.

Requirements

Break down the framework into specific obligations that must be met.

Tasks

Concrete actions and activities your team carries out to satisfy each requirement.

Policies

Documented rules and practices that are created and maintained as a result of completing tasks.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Start free trial
Effortless compliance improvement
Widest framework library in EU
Extensive support

Start your compliance journey

Use in MS Teams or use your browser with Slack integration.
Risk free trial. No credit card required. Stop at any time.

Start free trial
Book a meeting
How it works?
SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templatesTrust center
Use cases
By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementPrivacy managementVendor assessmentsInternal audits
Resources
AcademyWebinarsBlogHelp articlesVideo coursesContent libraryGuidesNewsletterLeave a reviewPartner programTeamTerms of usePrivacy policy
Contact us
+358 10 231 6010
team@cyberday.ai
App works in:
Known in Finland as Digiturvamalli
© Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
Cyberday.ai - Improve and certify your cyber security