How should we clean three years of customer data before an audit under the Saudi personal data protection law?

Under the Saudi Personal Data Protection Law, your company must draft a formal Privacy Policy and integrate explicit privacy notices into your website and quote forms. We strongly recommend establishing written procedures for every action you take as a data controller.

Cloud spreadsheets are your biggest audit risk because you can't track who exported what or when. Make the sheet read-only immediately, revoke permissions, and switch to a closed system with database logging while enforcing two-factor authentication.

Follow this order when cleaning up your marketing data: 1) Separate passive companies that haven't placed an order in the last two years, 2) Delete non-business personal phone numbers and emails from the sheet, 3) Send a privacy notice to active customers via SMS, 4) Move the invoice archive to a separate encrypted folder.

Out of the 12,000 registered customers, how many are corporate entities and how many are sole proprietorships? Under the law, B2B corporate billing info carries a completely different weight compared to directly identifiable personal data like mobile numbers and location.

note: I wrote this based on my own experience, it might not apply to everyone.

While prepping for a similar audit process, we realized that out of our 8,500-entry B2B customer list, almost 4,000 were outdated or duplicate records. We purged the unnecessary data and only sent privacy notices to the 4,500 active contacts, saved ourselves a huge headache.

Everyone panics as if fines will be slapped instantly but regulatory bodies usually prioritize companies that have suffered an actual data breach or received complaints. Still, keeping exposed data in a spreadsheet is practically begging for employee leaks; lock that down first.

first thing we did was lock down those open excel sheets. anyway if an employee takes that list to a competitor tomorrow, you'll be in deep trouble under both data privacy laws and trade secret regulations.

The most actionable step you can take first thing tomorrow: revoke all staff permissions to download the customer list to their local machines. Designate a single authorized point person and permanently delete all other local copies from your systems.

There's also a measurement aspect to this. When making decisions write down the worst-case scenario too, not just the best.

Trying to do this alone is the most expensive way. Just leaving this note it might be useful.

good call startig this thread but mistakes made on the Saudi personal data protection law side are usually reversible but expensive.

just because everyonne does it doesn't mean it's right and if I were you I'd go this route.

Same here.

I felt relieved reading this answer, so it's not just me. Everything goes well for the first three months; problems arise in the fourth.

This is my opinion, I'm not claiming it's absolute truth.

Yes, that's exactly how it is with Saudi personal data protection law. Security isn't absolute; it's about making attacks not worth the effort.

Same here. If it's your first time, start small; scaling comes later.

Good luck with that.

I'm writing this so you don't make the same mistake... Start with a small trial; don't commit to everything at once.

Correct me if I'm wrong.

The opposite happened to me, that's why I'm writing. Forgotten test environments are more often the entry point than live systems.

The answer varies greatly by industry; there is no one-size-fits-all rule. Good luck with that.

Exactly, and not many people know this. When we decide without measuring, we always end up in the same place.

I'm also curious if anyone does it differently.

Thanks, that was the answer I was looking for.