Saudi Personal Data Protection Law: We read the executive regulations PDF — where do we even start with implementation?

Sit down with HR and accounting first thing tomorrow morning. Clean out all the unnecessary scanned copies of IDs, iqamas, or driver's licenses sitting around on shared company network drives. Just deleting old job applications you no longer need will instantly cut your risk in half.

Pay close attention to the cross-border data transfer issue. If your accounting software or CRM system is hosted in a cloud region outside the Gulf, review the transfer conditions in the executive regulations. Request encryption standards and server locations from your vendor in writing.

If you get audited, the first documents an inspector will ask for are: 1) An up-to-date data inventory sheet, 2) Privacy notices and consent forms drafted for employees and suppliers, 3) Data retention and destruction procedure, 4) Information security incident response plan. If these four documents aren't on the table, the audit starts off on the wrong foot.

We're a 40-person distribution company in Riyadh. Before hiring outside consultants, we put together the inventory ourselves and it took 4 weeks. We found 3,000 old customer records and unnecessary ID scans in our CRM that hadn't been touched in 8 years. Just doing the cleanup alone took 50 hours of operational work.

Are your clients public sector or private sector? If you bid on government tenders in Saudi Arabia regulatory compliance is audited much more strictly. Also, are your servers hosted in a local data center or with international public cloud providers?

don't let that thick PDF scrae you, regulatory texts are always written based on the worst-case scenario then the key is being able to document that the company is making an effort and isn't just scattering data all over the place haphazardly. just prepare the essential forms and document your steps that's enough.

note: I wrote this based on my own experience, it might not apply to everyone.

we're in a similar boat do we also need to add a separate checkbox for the name and email coming from a basic contact form on our website? the old forms are just sitting there as is.

Exactly like that. If permission and scope aren't in writing, don't start that test.

Just leaving this note it might be useful.

I have no experience with personal data protection law, so Im asking. I mean if you scold false alarms, nobody will report again.

If you have questions, write them; I'll answer as best I can.

You're right. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

I'm a small business let me explain from my side. btw everything goes well for the first three months; problems arise in the fourth.

Correct me if I'm wrong.

I'd appreciate it if you shared the outcome.

There's one point I'm curious about. When making decisions, write down the worst-case scenario too, not just the best.

Of course, it varies if your situation is different.

Let me summarize what's been said so far. Processes without records never improve because you don't know what to fix.

Hope this helps.

It's rare to find an explanation this clear.

let me share what happened to me; it might be useful but if you get three differeent answers on a topic, the question was asked wrong.

if you have questions, write them; I'll answer as best I can.

I agree, and I'd like to emphasize that. If permission and scope aren't in writing, don't start that test.

That's all, sorry if I went on too long.

let me summarize the topic, since several different answers were given. dont hesitate to ask; those who dont ask always pay more.

if I were you, I'd go this route.