Programme overview
Technical depth: Practitioner · Practical mode: Case study
Introduction
Since the compliance grace period of Saudi Arabia's Personal Data Protection Law (PDPL) ended in September 2024, organisations operating in the Kingdom answer to SDAIA for how personal data is collected, used, shared and destroyed. Much of that data passes through administrative hands: HR files, visitor logs, supplier forms, correspondence and shared drives. This coreconcept KSA course equips administrative staff to apply the PDPL and its Implementing Regulation to daily work, alongside international privacy standards. Participants work through realistic office cases and leave with a PDPL Personal Data Handling Toolkit for their own unit.
Course Objectives
- Explain how the Saudi PDPL and its Implementing Regulation apply to the personal data handled in administrative work
- Identify where personal data enters, moves and is stored in forms, files, email and systems, and record it in a data inventory
- Apply the PDPL processing principles and lawful bases to routine administrative tasks
- Handle data subject requests, consent records and privacy notices using defined procedures and timelines
- Recognise personal data breaches and escalate them in time for notification to SDAIA within 72 hours
- Produce a PDPL Personal Data Handling Toolkit for one's own administrative unit
Target Audience
- Administrative officers who collect, file and share personal data in daily work
- HR and payroll administrators handling employee records and requests
- Secretaries, receptionists and front-office staff managing visitor and contact data
- Procurement and finance administrators handling supplier and customer personal data
- Records and correspondence staff who store, transfer and destroy files containing personal data
Course Outline
Day 1: Personal Data in Administrative Work and the Saudi PDPL
- Saudi PDPL Scope, Royal Decree M/19 and the Role of SDAIA
- PDPL Definitions: Personal Data, Sensitive Data, Controller, Processor and Data Subject
- Personal Data Touchpoints Map for HR, Reception, Procurement and Correspondence
- Administrative Data Inventory Template by Form, File and System
- Current-Practice Self-Assessment Checklist for an Administrative Unit
Day 2: PDPL Principles and International Privacy Standards
- PDPL Processing Principles: Purpose Limitation, Minimisation, Accuracy and Retention
- Lawful Bases under the PDPL Implementing Regulation: Consent, Contract and Legitimate Interest
- PDPL Data Subject Rights: Information, Access, Copy, Correction and Destruction
- ISO/IEC 29100:2024 Privacy Framework Principles Compared with the PDPL
- ISO/IEC 27701:2025 Privacy Controls Relevant to Office Operations
Day 3: Handling Personal Data Day to Day
- Privacy Notice Checklist for Forms, Visitor Logs and Email Signatures
- Consent Capture and Withdrawal Record
- Data Subject Request Log and Response Timeline Procedure
- Secure Sharing Rules for Email, Shared Drives and Printing Based on ISO/IEC 27002:2022
- Retention and Secure Destruction Rules for Personal Records Based on ISO 15489-1
Day 4: Breaches, Transfers and Problem Cases
- Breach Recognition and 72-Hour Escalation for SDAIA Notification via the National Data Governance Platform
- Cross-Border Transfer Checks under the SDAIA Regulation on Personal Data Transfer outside the Kingdom
- Processor and Vendor Data Sharing Agreement Checklist
- Privacy Impact Screening Questions Based on ISO/IEC 29134:2023
- Personal Data Protection Officer Referral Rules and Internal Escalation Matrix
Day 5: Case Work and the Personal Data Handling Toolkit
- HR File Request Case: Responding to an Employee Access Request
- Misdirected Payroll Email Case: Containment and Escalation
- Records of Processing Activities Extract for an Own Administrative Unit
- PDPL Personal Data Handling Toolkit Drafting
- Peer Review Panel and Toolkit Presentation
Skills You Will Gain
- Personal Data Identification
- Data Inventory Mapping
- Lawful Basis Selection
- Data Subject Request Handling
- Privacy Notice Review
- Secure Information Sharing
- Breach Recognition and Escalation
- Vendor Data Sharing Checks
Why Attend This Course
- Return to work with a PDPL Personal Data Handling Toolkit built around an administrative unit's own forms, files and systems
- Know what to do in the first hours after a misdirected email, lost file or other personal data incident
- Answer colleagues' and customers' questions about their personal data with confidence rather than guesswork
- Compare personal data handling practice with administrators from other sectors and organisations operating in Saudi Arabia
Conclusion
Personal data protection is decided less in policy documents than in the forms, emails and files that administrative staff handle every day. The course moves from mapping personal data in administrative work, through the Saudi PDPL principles, lawful bases and rights set beside international privacy standards, to the daily routines of notices, consent, requests, sharing and destruction, and then to breaches, transfers and vendor risks. The final day turns this into a PDPL Personal Data Handling Toolkit that participants apply in their own unit.