Simon Leadbetter
Associate Partner, GCC
GCC practice · Saudi Arabia
Governance, risk and compliance for the Kingdom, aligned with Vision 2030.
Saudi Arabia now runs one of the most demanding compliance environments in the region. Data protection is enforced, cybersecurity controls are audited, and financial regulators expect a working compliance function with evidence behind it.
We help organisations in the Kingdom, and the international groups that operate there, build one framework that answers to every regulator at once.
- Led by the partner who ran NEOM's PDPL compliance programme
- Experience drafting data protection law for a new Saudi regulator
- DPO as a Service for organisations in the Kingdom
§ 01The national agenda
Vision 2030
Trusted data and responsible technology are part of the national plan. Good governance is how organisations take part in it.
SDAIA AI Ethics Principles
The reference point for responsible AI in the Kingdom. We turn the principles into roles, controls and review steps for each AI system.
NDMO data governance
National data management and governance standards that shape how public bodies and their suppliers classify, share and protect data.
§ 02The regulators
01
SDAIA
Saudi Data and AI Authority
Supervises the Personal Data Protection Law and its implementing regulations, and sets AI ethics guidance.
02
NCA
National Cybersecurity Authority
Issues the Essential Cybersecurity Controls and sector controls for government bodies, critical infrastructure and their suppliers.
03
SAMA
Saudi Central Bank
Sets the Cyber Security Framework, the Business Continuity Management Framework and compliance rules for financial institutions.
04
CMA
Capital Market Authority
Issues the Corporate Governance Regulations for listed companies and rules for capital market institutions.
05
NDMO
National Data Management Office
Sets national data management and governance standards, under SDAIA.
§ 03What's live now
PDPL enforced since September 2024
The grace period has ended. SDAIA expects registration, records of processing, breach reporting and DPO appointments where required.
Draft amendments in consultation
SDAIA has consulted on amendments to the PDPL implementing regulations. We track the consultation and will explain what changes once the final text is published.
§ 04The team behind the work
Federico Marengo
Associate Partner, Head of AI and Transformation
Eva Mathur
Junior Associate, Governance, Compliance, and Data Protection
Meet the full team.
§ 05Your contact
Simon Leadbetter
Associate Partner, GCC
WhatsApp or call +971 558 701 959, or send us a message.