Programme overview
Technical depth: Practitioner · Practical mode: Case study
Introduction
The Saudi Personal Data Protection Law (PDPL) has been in force since September 2023, and the Saudi Data and AI Authority (SDAIA) now expects controllers to register, keep records of processing, notify breaches within 72 hours and, in defined cases, appoint a Personal Data Protection Officer. Many newly appointed DPOs inherit these duties without a programme, a data map or clear authority. This Core Concept course equips them to build and run a PDPL privacy programme, using ISO/IEC 27701 and related international standards alongside SDAIA rules, and to leave with a PDPL Privacy Management Programme Plan.
Course Objectives
- Interpret the PDPL, its Implementing Regulation and SDAIA rules as they apply to the organisation's processing activities
- Establish the DPO role, reporting line and privacy governance model in line with the SDAIA Rules for Appointing a Personal Data Protection Officer
- Maintain records of processing, lawful basis assessments, privacy notices and data subject rights procedures
- Conduct personal data impact assessments using SDAIA requirements and ISO/IEC 29134:2023
- Manage breaches, cross-border transfers and processor relationships under the PDPL and its transfer regulation
- Produce a PDPL Privacy Management Programme Plan ready for executive approval
Target Audience
- Managers appointed as Personal Data Protection Officer for a controller
- Privacy and data protection programme managers in public entities and private companies
- Legal and compliance managers responsible for PDPL obligations
- Data management office managers linking privacy with data governance
- Information security and risk managers supporting privacy controls and breach response
Course Outline
Day 1: The PDPL Landscape and the Current State
- Saudi PDPL Scope and Definitions: Royal Decree M/19 as Amended by Royal Decree M/148
- Controller, Processor and Data Subject Roles under the PDPL Implementing Regulation
- SDAIA Oversight and National Data Governance Platform Registration Rules
- Privacy Principles Compared: PDPL, OECD Privacy Guidelines and ISO/IEC 29100
- Personal Data Inventory and Data Flow Mapping
Day 2: The DPO Role and Privacy Frameworks
- SDAIA Rules for Appointing a Personal Data Protection Officer: Triggers, Qualifications and Reporting Line
- ISO/IEC 27701:2025 Privacy Information Management System Requirements
- NIST Privacy Framework Functions and Profiles
- Privacy by Design Principles with ISO 31700-1:2023
- Privacy Governance Model: DPO Charter, Data Management Office Link and RACI
Day 3: Operating the Privacy Programme
- Records of Processing Activities Template and Maintenance
- Lawful Basis Assessment: Consent, Legitimate Interest and Legal Obligation under the PDPL
- Privacy Notice Drafting and Consent Records with ISO/IEC TS 27560:2023
- Data Subject Rights Request Procedure and Response Log
- Personal Data Impact Assessment with ISO/IEC 29134:2023
Day 4: Breaches, Transfers and High-Risk Processing
- Personal Data Breach Response and 72-Hour Notification to SDAIA
- Cross-Border Transfers under the Regulation on Personal Data Transfer outside the Kingdom
- Processor Due Diligence and Data Processing Agreement Clauses
- Sensitive, Health and Children's Data Handling Controls
- Privacy Risk Review for AI, CCTV and Marketing Analytics
Day 5: Case Work and the PDPL Privacy Programme Plan
- Banking Case Study: Customer Data Breach Notification Decision
- Healthcare Case Study: Patient Data Transfer to an Overseas Cloud Provider
- Privacy Maturity Gap Assessment for an Own Organisation
- PDPL Privacy Management Programme Plan Drafting
- DPO Executive Briefing and Plan Defence
Skills You Will Gain
- PDPL Interpretation
- Privacy Programme Governance
- Data Mapping
- Privacy Impact Assessment
- Data Subject Rights Handling
- Breach Notification Management
- Cross-Border Transfer Assessment
- Processor Oversight
Why Attend This Course
- Return with a PDPL Privacy Management Programme Plan built on your own processing activities
- Clarify the authority, independence and resources the DPO role needs to function
- Recognise the breach, transfer and sensitive data situations that carry the greatest regulatory exposure
- Compare practice with privacy professionals from banking, healthcare, government and other sectors
Conclusion
PDPL compliance becomes sustainable when a capable DPO runs a programme that the organisation understands and supports. This course moves from the Saudi PDPL and SDAIA framework, through the DPO role and the international privacy standards that support it, to the records, assessments, rights handling, breach response and transfer decisions that make up daily privacy work. The final day produces a PDPL Privacy Management Programme Plan that participants take back to their executives as the roadmap for the year ahead.