Saudi Personal Data Protection Law: we have legacy customer data — where do we even start?

Don't overlook ZATCA regulations under any circumstances. In Saudi Arabia, the requirement to keep financial and tax records overrides PDPL rules. If you delete invoice records required by the tax authority assuming they're just personal data, you'll face severe penalties during a financial audit. Just clean up the marketing emails and phone numbers you've been keeping without explicit consent.

We went through the exact same thing for our wholesale business in Jeddah. A law firm asked for 35,000 SAR. We spent two weekends categorizing 8,000 legacy records in a spreadsheet. We outright deleted 3,400 addresses that hadn't transacted in the last three years, keeping only the official invoice archives. We registered the company on the official portal and sorted it out with zero expenses.

When deleting data, dropping rows from the database isn't enough. You also need to account for copies in your backup systems. PDPL audits will look at the entire data lifecycle. Permanently wipe PDF archives containing old customer ID scans using secure file deletion tools, and log when and how you did it in a formal destruction report.

the cleanest thing we did was wiping whatsapp groups and old client numbers saved in phone contacts. keeping id photocopies is the riskiest part anyway the law treats them as sensitive data. delete them right away to save yourself the headache.

Don't buy into the fearmongering from agencies trying to squeeze 40k to 50k riyals out of you. The authority isn't going to raid a small business like police overnight; they issue warnings and give you time to fix deficiencies first. What matters is having a reasonable data protection policy in place and documentation showing you've trained your staff.

Under the Personal Data Protection Law, your processing activities must be grounded in legitimate interest, contract performance, or statutory obligations. The duty to inform arises at the moment of collection. For legacy customers, publishing an accessible privacy policy on your website or providing it upon your next communication meets the legal minimum.

Are physical paper copies of technical service receipts also covered under this law? Do we need to scan and destroy all the printed service slips from the last five years sitting in boxes in our warehouse or are audits only concerned with digital records?

Don't panic at all, just start with a simple Excel spreadsheet. Create columns for data type, origin storage location, and legal basis. The official authority's portal has free sample privacy notices and checklists; you can adapt those Arabic and English templates to fit your business.

I can't fully agree with this. Taking notes for two weeks yields better results than a six-month estimate.

If you get three different answers on a topic, the question was asked wrong. Just leaving this note it might be useful.

To get into the details: People defend habits, not processes. Resistance comes from there.

Of course it varies if your situation is different.

Let me summarize the topic, since several different answers were given. An untested backup is not a backup.

Hope this helps.

Here's how it went for us. Start with a small trial; don't commit to everything at once.

If I were you, I'd go this route.

I didn't know that.

I'm curious too. Forgotten test environments are more often the entry point than live systems.

Good luck with that.

Quick summary for newcomers: The answer varies greatly by industry; there is no one-size-fits-all rule.

Mistakes made on the Personal data protection law side are usually reversible but expensive.

We experienced almost the exact same thing last year. When making decisions, write down the worst-case scenario too, not just the best.

Correct.

the discussion got scattered, let me summarize. tbh when making a decision first look at what data you have on hand.