Make personal data rules work inside your systems

The Personal Data Protection Law, known as PDPL, is the Kingdom's framework for how personal data is collected, used, stored, shared and deleted. The Saudi Data and AI Authority (SDAIA) is the competent authority. The law gives individuals rights such as access to their data, correction, and destruction when the purpose has ended. It places duties on the organizations that decide why and how data is processed, called controllers.

For a software team, several duties become engineering tasks. You must know what you collect and for what purpose. You need a lawful basis for each purpose, which in many cases is consent that can be withdrawn. You must keep data only as long as the purpose needs. You must protect it with suitable security controls, and you must notify when a leak could harm individuals.

Sensitive categories, such as health, financial and credit data, genetic data and data about children, call for extra care. If your product serves clinics, lenders, schools or employees, tell us early. The design choices differ, and a wrong early decision costs far more to undo after launch.

We work in three layers. The first is knowledge: a personal data inventory built by reading your schemas, integrations and forms, and by interviewing the teams who use the data. Spreadsheets of assumptions are not enough, so we check what the systems really store.

The second layer is behavior. We add consent capture that records purpose, wording version and timestamp. We build a request workflow so access, correction and deletion requests are tracked against their deadlines. We add retention jobs, field-level protection for sensitive columns, role-based access, and audit logs that show who viewed what. These are normal engineering tasks. They are tedious to retrofit and straightforward to design in.

The third layer is paper that matches reality: privacy notices in Arabic and English, a processor register, impact assessments for risky processing, and a breach runbook. Because we write these after building the controls, they describe what the system does, not what someone hoped it would do. A first build typically takes four to eight weeks, depending on how many systems hold personal data.

Where data lives and where it travels matters under the law. Moving personal data outside the Kingdom is allowed only on defined conditions, and sector regulators add their own rules. Some sectors, such as banking and cloud services used by regulated entities, also have hosting expectations from SAMA and the Communications, Space and Technology Commission. We review your transfers and vendors, and where it helps we design for in-Kingdom hosting so the question never arises.

We are engineers, not your legal counsel. We build to the requirements of the law as published, and we flag the points where a lawyer should decide, such as lawful basis for a borderline purpose or the wording of a contract with a processor. We recommend you involve counsel on those, and we are happy to work from their instructions.

Nothing we deliver is a certification or a regulator's approval. What you get is a system that follows the rules by default, records that show it, and a team that knows how to answer a request or an inquiry. That is what a regulator or an enterprise customer will ask to see.