SDAIA begins circulating PDPL compliance verification form

The Saudi Data and Artificial Intelligence Authority (SDAIA) has begun circulating the Personal Data Protection Law (PDPL) Compliance Verification Form to registered controllers. The form sets out the information and evidence organisations must provide to demonstrate compliance with Saudi Arabia’s Personal Data Protection Law. It covers all key areas of data governance, from how personal data is collected, processed and stored, to the policies, systems and controls in place to protect it. The form requires organisations to evidence robust governance frameworks, clear legal bases for processing, effective management of third parties, defined retention and destruction practices, and mechanisms to uphold data subject rights. It also addresses cross-border data transfers, incident response, and the appointment of a data protection officer.