Compliance & AssurancePDPL
We map the personal data you hold, record why you hold it, set up rights and breach processes and apply the security controls the Personal Data Protection Law expects, with a programme your privacy team can run.
01Overview
The PDPL is Saudi Arabia's data protection law, in force since 14 September 2023 and supervised by the Saudi Data and AI Authority (SDAIA). It sets rules for collecting, using, storing, sharing and transferring personal data, gives individuals rights over their data and creates penalties for violations.
Organisations that process the personal data of individuals in the Kingdom, including some based outside it.
A lawful purpose, transparency, security, limits on retention and transfers, rights handling and breach notification.
Individuals can be informed, access, correct and request destruction of their data, and withdraw consent.
The law provides for warnings, fines and, for some offences, imprisonment. Confirm the details with your counsel.
02What we do
A programme the privacy team can run day to day.
Find what personal data you hold, where and why.
What you receive
A map every other task depends on.
Compare practice with PDPL obligations.
What you receive
A scored gap register.
Procedures and tooling for requests and consent.
What you receive
Requests handled on time.
Technical and organisational measures for personal data.
What you receive
Controls proportionate to risk.
Procedures to detect, assess and notify.
What you receive
A tested response.
Cross-border transfers and processor oversight.
What you receive
Transfers you can justify.
03How we work
Four phases.
Phase 1 · Weeks 1 to 6
Map personal data and processing.
Phase 2 · Weeks 6 to 8
Gap assessment and risk ranking.
Phase 3 · Months 3 to 8
Policies, processes and controls.
Phase 4 · Ongoing
Run rights, breach and reviews; DPO support.
04Reference
A plain-language summary. Check the law and regulations for exact text.
| Right or duty | What it means | What we set up |
|---|---|---|
| Right to be informed | People are told what is collected and why | Privacy notices and consent text |
| Right of access | People can obtain a copy of their data | Request process and search tooling |
| Right to correction | Inaccurate data can be fixed | Correction workflow |
| Right to destruction | Data can be deleted in defined cases | Deletion and retention controls |
| Consent and withdrawal | Consent is clear and can be withdrawn | Consent management |
| Security and breach duties | Protect data and report serious breaches | Controls, breach playbook, notification |
| Transfer limits | Transfers abroad need conditions | Transfer register and safeguards |
05Saudi Arabia and the GCC
The PDPL works alongside sector and national rules.
SDAIA supervises the PDPL, and the National Data Management Office publishes data governance standards that many entities follow.
Financial, health and telecom regulators add requirements. We map them together.
The NCA's Data Cybersecurity Controls address classification and protection.
Bahrain, Oman, the UAE and others have their own laws. We map overlaps for regional firms.
06Why GoAgile
We know where your data lives.
ERP, CRM, data and infrastructure teams in-house.
Processes the team can run.
Controls built, not just described.
A named DPO service if you need one.
Records for SDAIA and customers.
Notices in both languages.
Credentials
07Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
Patient data sat in many systems, with no single record of what was held, why, or who could see it.
Result: A defensible PDPL position and a process the privacy team could run day to day.
The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.
Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.
Plant networks had grown without a clear map, and remote access for vendors was a concern.
Result: A mapped, segmented network with a prioritised remediation plan the plant team could schedule.
Client names are withheld for confidentiality.
08Related services
Each service stands alone and works better with the others.
Tell us your sector and systems. We will propose a data mapping and gap assessment.
Start a PDPL programme09Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.