Saudi PDPL Awareness Training

Opens with an exercise: follow one form your company uses and ask who reads it, where it is stored, who receives a copy and when it is deleted. Shows personal data in order systems, HR files and sick notes, apps, cookies and store cameras. Reports the Saudi Press Agency's January 2026 account of the first year of SDAIA violation committee decisions: 48 decisions in 2025, covering unlawful collection and processing, disclosure without legal justification, missing protection measures and marketing messages sent without consent. Explains that the PDPL was issued by Royal Decree in 2021, amended in 2023, came into force on 14 September 2023, and that the grace period ended on 14 September 2024. Sets out its reach under Article 2, including processing abroad of data of people living in the Kingdom. Introduces LMN Retail Company, a worked example of a retailer in Riyadh, and the course structure.

What you will be able to do

• Explain why the Saudi PDPL exists, when it came into force and who it applies to
• Identify where personal data sits in everyday work across customers, staff, apps and cameras
• Describe the types of violation found in SDAIA's 2025 committee decisions

Why it matters

Shows every employee, including service providers abroad, why the PDPL reaches their daily work and why SDAIA is already issuing decisions.

Practice: Practice: Why the PDPL matters · 3 questions

Starts with a new marketing manager joining LMN Retail from London. Lays out the rulebook: the 43-article law, the Implementing Regulation, the Transfer Regulation version 2.0 of August 2024, SDAIA's rules on DPOs and registration, and its guides. Explains SDAIA's role under Article 30, the Saudi Central Bank's powers in its own field, and the licensing of accreditation and audit bodies under Article 33. Describes the National Data Governance Platform for registration, breach notification and complaints. Sets out the Article 2 scope, with an online travel agency in Dubai serving families in the Kingdom, the data of people who have died, and the personal and family use exclusion. Shows why customer numbers on a personal phone are still work data. Covers links to NCA controls and sector rules, the dates from 2021 to 2024, and the mistake of thinking it is someone else's law.

What you will be able to do

• Identify the law, regulations, rules and guides that make up the Saudi PDPL rulebook
• Explain SDAIA's role and how the National Data Governance Platform is used
• Apply the Article 2 scope and the personal and family use exclusion to real cases

Why it matters

Helps staff in the Kingdom and at service providers abroad know which rules apply, where they come from and when to involve the DPO.

Practice: Practice: The law, its regulations and SDAIA · 3 questions

Begins in LMN Retail's contact centre with a caller who reads out only a loyalty number, and asks whether that is personal data. Explains the wide Article 1 definition, data that identifies a person directly or indirectly, and why the loyalty number counts. Lists the sensitive data categories, from ethnic origin and beliefs to biometric, genetic and health data, with a warehouse fingerprint clock and HR sick notes as examples. Defines health data, credit data and genetic data. Shows that processing covers every operation, including simply reading a record. Explains controller and processor, applied to LMN Retail, its marketing platform, its customer care partner and a finance company that is a controller in its own right. Covers data subjects, legal guardians for people without full capacity, pseudonymisation and anonymisation with a Sydney university survey, and a Paris marketing agency treated as a controller after reusing a client's list.

What you will be able to do

• Recognise personal data that identifies a person directly or indirectly, such as a loyalty number
• Identify the categories of sensitive data under the Saudi PDPL
• Distinguish a controller from a processor from the facts of who decides why and how

Why it matters

Gives staff the vocabulary to spot personal and sensitive data in their own work and to know which role their organisation plays.

Practice: Practice: Personal data and who does what · 3 questions

Opens with an LMN Retail checkout design where one tick box would cover orders, offers, profiling and sharing. Explains Article 5, where consent is the starting point and can be withdrawn at any time, and the five conditions for valid consent: freely given, specific purposes, full legal capacity, documented and separate for each purpose. Sets out when consent must be explicit: sensitive data, credit data and solely automated decisions. Explains why consent cannot be made a condition of a service, and why withdrawal must be as easy as giving consent. Covers the other legal bases in Article 6, including another law, an agreement with the person and legitimate interest, with its documented assessment and a Singapore bank's fraud screening as the example. Covers purpose limits, minimum data and data maps, accuracy and destruction, then redesigns the tick box so each extra use gets its own recorded choice.

What you will be able to do

• Explain the conditions for valid Saudi PDPL consent and when it must be explicit
• Identify when processing can rest on another legal basis instead of consent
• Apply purpose limits and minimum data rules when designing a form or checkout page

Why it matters

Helps product, marketing and sales teams design forms that collect only what is needed, with consent choices that can be shown to SDAIA.

Practice: Practice: Lawful processing and consent · 3 questions

Starts with a customer e-mail at an LMN Retail store asking for all their data and deletion, left in a supervisor's inbox. Explains the privacy policy, SDAIA's guideline on writing one, and what people must be told at collection: the controller and DPO contacts, the legal basis and purpose, retention, recipients, transfers outside the Kingdom, rights and which data is mandatory. Covers the 30-day notice when data comes from a third party, such as a referral. Sets out the five rights under Article 4: to be informed, to access, to get a copy, to correct and to ask for destruction. Explains the request process: record every request, verify identity, answer within 30 days, extendable by 30 more with notice and reasons. Walks through access with a Hong Kong call recording, correction, destruction and legal retention of tax invoices, request channels, and forwarding the e-mail the same day.

What you will be able to do

• Identify what a privacy notice must tell people when their data is collected
• Recognise an access, correction or destruction request even when no legal words are used
• Route a data subject request the same day so it is answered within 30 days

Why it matters

Prepares front-line staff to spot and pass on data subject requests at once, avoiding missed deadlines that can turn into complaints to SDAIA.

Practice: Practice: Privacy notices and individual rights · 3 questions

Follows a Thursday evening when a marketing assistant's autocomplete sends a spreadsheet of 30,000 loyalty members to an outside address. Explains the Article 19 duty to protect data with organisational, administrative and technical measures, the link to NCA controls, and four daily habits: lock your screen, check the recipient, access only what your role needs and use approved tools. Covers the Article 41 confidentiality duty that continues after a job or contract ends. Defines a breach as any disclosure, destruction or unauthorised access, accidental or deliberate, on screen or paper. Sets out notification to SDAIA within 72 hours of awareness where harm is possible, how the data protection team decides, what the notice contains and how affected people are told. Covers processors' duty to tell the controller, with a Dubai travel agency, the corrective measures LMN Retail adopts, and why the assistant must report within minutes.

What you will be able to do

• Recognise a personal data breach, whether accidental or deliberate, digital or on paper
• Explain the 72-hour SDAIA notification and what the notice must contain
• Apply the stop, report, keep evidence and stay quiet steps after a breach

Why it matters

Helps staff report breaches within minutes so the organisation can assess harm and meet the 72-hour SDAIA deadline with proper records.

Practice: Practice: Security and data breaches · 3 questions

Opens with LMN Retail's summer sale plan: a cheaper text message vendor, a partner brand asking for the member list, and messages to two million loyalty members. Explains Article 8, where the controller chooses capable processors, monitors them and stays responsible, and the clauses the processing agreement must include, from purpose and duration to breach notice and sub-contractors. Covers sub-processor approval and a Mumbai software company that moves client data without permission. Sets out the six disclosure cases in Article 15 and why the partner brand request fails without consent. Explains Articles 25 and 26 on advertising and direct marketing: consent, a named sender and an easy way to stop, with unconsented messages among SDAIA's 2025 violations. Covers limited access to health data, explicit consent for credit data, and Article 28 on not copying or photographing official ID documents. Ends with a Sydney university that outsources questionnaires.

What you will be able to do

• Explain what the controller must check and agree before appointing a processor
• Identify the cases in which personal data may be disclosed to another party
• Apply the consent, named sender and easy opt-out rules to marketing messages

Why it matters

Keeps marketing, procurement and front-line teams within the PDPL when sharing data, sending campaigns or handling ID documents and credit data.

Practice: Practice: Processors, sharing and marketing · 3 questions

Starts with a team leader uploading a customer list to a trial feedback tool with servers in three countries. Explains that a transfer includes storing data abroad and giving a team abroad access. Sets out the permitted purposes, including the three named in the Transfer Regulation, then the three conditions: no harm to national security or the Kingdom's vital interests, adequate protection based on SDAIA's assessment, and minimum data. Describes SDAIA's adequacy list, reviewed every four years, and the exemption safeguards: standard contractual clauses, binding common rules and accreditation certificates. Explains when a written transfer risk assessment is required and what it covers, onward transfers and when an exemption stops applying. Applies the steps to the customer care partner abroad. Cites the May 2023 fine of 1.2 billion euros imposed on Meta by Ireland's Data Protection Commission under EU law, and closes with three questions to ask first.

What you will be able to do

• Explain when uploading or giving access to data counts as a transfer outside the Kingdom
• Describe the purposes and three conditions a transfer must meet
• Identify the safeguards and risk assessment needed when an exemption case is used

Why it matters

Stops teams moving customer data abroad through unchecked cloud tools, and prepares them to give the DPO the facts a transfer decision needs.

Practice: Practice: Transfers outside the Kingdom · 3 questions

Opens with an app feature that tracks location near stores and uses an algorithm to decide discounts, with a fixed launch date. Explains Article 22 and the triggers for a written impact assessment: sensitive data, linked datasets, constant monitoring, new technologies, automated decisions and likely serious harm. Sets out what the assessment contains and why harm found must be fixed and reassessed, with a Mumbai developer building a switch-off option. Covers Article 31 records of processing, kept in writing and for five years after each activity ends, and what each entry holds. Explains when a DPO must be appointed, SDAIA's examples of systematic monitoring and core activities, the DPO's tasks and how the controller supports the role. Describes the national register of controllers and its registration certificate. Gives four moments to call the DPO, the evidence LMN Retail could show SDAIA, and the mistake of paperwork after launch.

What you will be able to do

• Identify when a written data protection impact assessment is required before processing
• Describe what records of processing activities must contain and how long they are kept
• Explain when a DPO must be appointed and when employees should contact them

Why it matters

Helps teams build impact assessments and records into new projects from the start, so the organisation can show SDAIA its compliance on request.

Practice: Practice: Accountability: assessments, records, DPOs · 3 questions

Starts with the CEO of LMN Retail asking the DPO for the worst case. Explains complaints under Article 34, filed within 90 days, and how SDAIA handles them. Sets out the penalties as the course states them: up to two years in prison and a fine of up to 3 million riyals for harmful disclosure of sensitive data under Article 35, and a warning or a fine of up to 5 million riyals for other violations under Article 36, doubled for repeats. Covers confiscation, public notices, discipline in public entities and compensation, then the inspection and committee process and the right to appeal. Reads the 2025 decisions as lessons. Describes the October 2026 public consultation on amendments, which remain proposals until adopted. Sets out duties for front line, marketing, HR, IT and procurement, four habits, and follows the location feature from idea to launch before the thirty-question exam.

What you will be able to do

• Explain how data subject complaints reach SDAIA and how violations are decided
• Describe the penalties and other consequences the PDPL sets for violations
• Apply the four everyday habits that protect personal data in your own role

Why it matters

Leaves each learner clear on what non-compliance can cost and on the daily habits that prevent complaints, fines and lost customer trust.

Practice: Practice: Enforcement, what is changing and your role · 3 questions