Do we need a DPO under the Saudi PDPL?
It depends on your processing, and the triggers are set out in SDAIA's Rules for Appointing a Personal Data Protection Officer, issued in August 2024. A DPO is required where (1) the organisation is a public entity providing services that involve processing personal data on a large scale; (2) its core activities involve regular and systematic monitoring of individuals, for example tracking, location data, cookies, CCTV or behavioural analytics; or (3) its core activities involve processing sensitive personal data, such as health or credit data. Organisations outside these cases may appoint a DPO voluntarily, and must review periodically whether the requirement has started to apply. If any apply, the appointment must be documented and the DPO's contact details provided to SDAIA through the National Data Governance Platform.
Can an external provider act as our DPO in Saudi Arabia?
Yes. Article 4 of the SDAIA DPO Rules allows the DPO to be an executive, an employee or an external contractor, and Article 6 requires a written agreement with an external DPO. WLC can be appointed, with Simon Leadbetter as the named lead. The appointment is documented in the same way as an internal one, and the contact details registered with SDAIA are those of the appointed DPO.
Does our DPO need to be based in Saudi Arabia?
The SDAIA DPO Rules do not set a residency requirement. WLC's lead DPO for Saudi Arabia, Simon Leadbetter, works across Saudi Arabia and the wider GCC, and is supported by WLC colleagues in Europe and the Gulf. We will confirm with you how the residency position applies to your organisation before the appointment is made.
How do we register our DPO with SDAIA?
The DPO's contact details are provided to SDAIA through the National Data Governance Platform. The appointment itself must be documented, and the same contact details must be made available to data subjects, for example in your privacy notice. When WLC is appointed, we prepare the documentation and support you through the platform submission.
What qualifications does a DPO need under the SDAIA rules?
The SDAIA rules require appropriate academic qualifications, data protection experience, and knowledge of risk management and regulatory requirements. They set minimum requirements rather than one named certificate. WLC's lead DPO for Saudi Arabia is a lawyer holding the FIP, CIPP/E and CIPM certifications, with six years leading PDPL compliance at NEOM.
Does appointing an external DPO transfer our legal responsibility?
No. The controller remains responsible for complying with the PDPL, whoever holds the DPO role. An external DPO advises, monitors compliance, deals with SDAIA and data subjects, and reports to your management. Decisions on how personal data is processed, and accountability for them, stay with your organisation.
Can our CISO or compliance officer also be the DPO?
Article 9 of the SDAIA DPO Rules says the controller must not give the DPO tasks that conflict with the DPO role or affect the DPO's independence. In practice, the DPO should not hold a role that decides how personal data is processed, because that creates a conflict of interest. Where an internal person holds the role, WLC can support them so the independence of the function is maintained.
How does the Saudi PDPL compare with the GDPR?
The two laws share many concepts, including legal bases, data subject rights and transfer restrictions, but they differ in detail. Our comparative analysis of the GDPR and selected Middle East privacy laws sets out where they align and where they diverge, which helps groups that already run a GDPR programme extend it to Saudi Arabia.
Can one DPO cover Saudi Arabia and our European entities?
The SDAIA DPO Rules do not require the DPO to be based in Saudi Arabia, so a group DPO elsewhere is not ruled out, provided data subjects and SDAIA can reach them and they have the required knowledge of the PDPL. A common model is a group DPO in Europe with a local data protection lead in Saudi Arabia. WLC works in both regions, so it can provide the local lead, support your group DPO, or hold both roles where the law allows it.
How quickly can WLC be appointed?
Timing depends on how ready your documentation is, and we agree it with you at the outset. The engagement starts with the formal appointment, registration of the DPO's contact details and a kick-off with your stakeholders. The first 90 days then cover a review of current processing, a gap assessment and the first board report.
Where are our DPO records stored?
Records of processing, DPIAs, data subject requests and breach logs are the records a DPO keeps on your behalf. We agree with you at the start of the engagement where they are hosted and who can access them, so the arrangement suits your own policies.
