Ting Guides · For the CTO and CIO
What should you check under the PDPL before an AI system uses personal data?
The short answer
Check the legal basis for each purpose, whether decisions will be made solely by automated processing, whether an impact assessment is required, where the data goes if it leaves the Kingdom, what you keep in the processing record, and how you would notify a breach. Then test the system against those answers before launch.
Updated
What it depends on
Where personal data goes in the system
Write down every place personal data enters, is stored, is sent to a model and leaves: the request, retrieved documents, logs, any training data, and the outputs. The checklist is only as complete as this map.
Whether the system decides anything about a person
An assistant that drafts replies for staff to send is different from a system whose output decides something about a person on its own. Several checks below apply only to the second.
Where the model and its logs run
Ask your provider where requests, outputs and logs are processed and kept. Whether that is inside or outside the Kingdom decides which transfer rules apply.
Who owns each answer
Name an owner for every check: your legal adviser for the legal basis and transfers, IT for security and logs, and the business owner for the purpose and how long data is kept.
What should you check, point by point?
The Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H) and its Implementing Regulation, as they apply to an AI system.
The checklist · copy it into your launch file
Legal basis recorded for each purpose; a separate consent for each purpose where consent is the basisLaw Arts. 5–6 · IR Art. 11(1)
OwnerLegal adviser
Evidence that closes itThe processing record, purpose by purpose
What the law says · A legal basis for each purpose
Except in the cases the Law sets out, personal data may not be processed, nor its purpose changed, without the data subject's consent (Article 5(1)); Article 6 lists the cases where consent is not required, including the controller's legitimate interest, where it does not prejudice the data subject's rights and interests and no sensitive data is processed. Where consent is relied on, the Implementing Regulation requires a separate consent for each processing purpose (Article 11(1)).[1][2]
Requests, retrieval results and logs carry only the fields the purpose needsLaw Art. 11(3)
OwnerBusiness owner and IT
Evidence that closes itA reviewed sample of real requests and logs
What the law says · Only the data the purpose needs
The content of personal data must be limited to the minimum necessary to achieve the purpose of collection (Article 11(3)). Check what your requests, retrieval results and logs actually carry, not what the design says.[1]
Decide whether any decision is made solely by automated processing; if so, explicit consent and a noticeIR Arts. 11(2), 4(5)
OwnerBusiness owner and legal adviser
Evidence that closes itA map of what each output decides
What the law says · Decisions made solely by automated processing
Consent must be explicit when decisions are made solely on the automated processing of personal data (Implementing Regulation, Article 11(2)), and a controller whose activities include, on a large scale or repeatedly, making decisions based on automated processing must tell data subjects whether decisions will be made solely by automated processing (Article 4(5)).[2]
Impact assessment done where the product is offered to the public or a listed case appliesLaw Art. 22 · IR Art. 25(1)
OwnerLegal adviser
Evidence that closes itThe signed assessment
What the law says · An impact assessment
The controller must assess the impact of processing personal data for any product or service offered to the public, according to the nature of the activity (Law, Article 22). The Implementing Regulation lists the cases where an assessment is required, including when the controller's activity includes, on a large scale or repeatedly, processing personal data based on newly adopted technologies or making decisions based on automated processing (Article 25(1)).[1][2]
Every transfer outside the Kingdom recorded with its condition or exemption and its safeguardsLaw Art. 29 · Transfer Regulation Art. 4
OwnerLegal adviser
Evidence that closes itThe hosting map and the contract clauses relied on
What the law says · Transfers outside the Kingdom
Article 29 sets conditions for transferring personal data outside the Kingdom, including an adequate level of protection and the minimum data needed; the Transfer Regulation sets the exemptions from those two conditions and the safeguards they require, such as standard contractual clauses (Article 4).[1][3]
A written record of processing, transfers and recipients includedIR Art. 33
OwnerData protection lead
Evidence that closes itThe current record, dated
What the law says · A record of processing
Keep a written record of processing activities while the processing continues and for five years after it ends (Implementing Regulation, Article 33(1)), including transfers outside the Kingdom, their legal basis and the recipients (Article 33(5)).[2]
Security measures in place, and a breach plan that can notify SDAIA within 72 hoursLaw Art. 19 · IR Art. 24
OwnerIT security
Evidence that closes itThe breach runbook and the date of its last drill
What the law says · Security, and a breach plan
The controller must take the organizational, administrative and technical measures needed to protect personal data, including when it is transferred (Law, Article 19). If a breach may harm the personal data or the data subject, or conflict with their rights or interests, notify SDAIA within 72 hours of becoming aware of it (Implementing Regulation, Article 24(1)), and notify the data subject without undue delay if it may harm their data or conflict with their rights or interests (Article 24(5)).[1][2]
Decide whether a data protection officer is required, and appoint one if soIR Art. 32(1) · DPO Rules
OwnerExecutive management
Evidence that closes itThe decision, and the appointment where required
What the law says · A data protection officer, where required
A controller must appoint one in three cases, including when its core activities are based on processing that requires regular and systematic monitoring of data subjects, or on processing sensitive data (Implementing Regulation, Article 32(1)). SDAIA's Rules for Appointing a Personal Data Protection Officer (version 1.0, August 2024) set the criteria for large-scale processing.[2][4]
Access, correction and destruction requests can be acted on within thirty daysLaw Art. 4 · IR Art. 3(1)
OwnerCustomer service and IT
Evidence that closes itOne test request run end to end
What the law says · Requests from data subjects
Data subjects can ask to access, correct, complete or update their personal data, and to destroy personal data that is no longer needed (Law, Article 4). The controller acts on a request within thirty days; it may extend this by up to thirty more days where the request needs disproportionate effort or the data subject has sent multiple requests, with advance notice of the extension and its reasons (Implementing Regulation, Article 3(1)).[1][2]
What about the amendments under consultation?
What this checklist doesn't cover
General information, not legal advice. Each regulatory point summarises the official source cited beside it, as checked on the date shown under Sources; confirm how it applies to your company with your legal adviser.
Sector rules
Banks, insurers and healthcare providers answer to sector regulators with their own requirements. This checklist doesn't cover them; add them with your legal adviser.
Data you handle for a government entity
The NDMO's Data Management and Personal Data Protection Standards (version 1.5) are intended for public entities, and their scope extends to business partners handling government data.[6]
Cybersecurity controls
The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) apply to government entities and to private entities that own, operate or host critical national infrastructure; the Authority encourages other entities to use them.[7]
A customer-service assistant, mapped before the checklist
ExhibitWorked example
An assistant that answers order questions on the website of Rasikh Trading, part of the fictional Rasikh Holding. This is the data map the checklist starts from, with the open points it surfaced.
| Where personal data appears | What the assistant does | Open point for the owners |
|---|---|---|
| The customer's message | Reads the name, mobile number, order number and the question | Is the name needed to answer an order-status question? If not, don't send it to the model |
| Retrieved content | Looks up delivery policies, which hold no personal data | None |
| Order lookup | Reads the status of that customer's order through a live tool | Only the order belongs to this customer, checked against the sign-in |
| Logs | Keeps every conversation | Decide how long, and how one person's conversations are found and deleted on request |
| Model hosting | Runs with a provider outside the Kingdom | Legal adviser to confirm the transfer route and record it |
| Decisions | Answers; a staff member approves any refund | No decision is made solely by automated processing |
The decisionNone of the open points needed a new model. They needed answers from the owners, written down before launch.
Questions people ask
Does the PDPL forbid using AI on personal data?
Must personal data be stored inside Saudi Arabia?
Is this checklist legal advice?
What Ting does and doesn't do here
What we do
- AI Solution Evaluation tests a system against these points before launch or while it is live: what personal data it sends, logs and keeps, and whether access and deletion requests can be honoured.
- We map where personal data flows through requests, retrieval, logs and model hosting, so your legal adviser has the facts to decide on.
Where Ting helps: AI Solution Evaluation
What we don't do
- We don't give legal advice, and we don't certify compliance with the PDPL or any SDAIA document.
- We don't choose your legal basis or your transfer route; your legal adviser does.
Sources
Primary sources only, each read in full on the date shown.
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H)SDAIA · checked
- Implementing Regulation of the Personal Data Protection Law (published 1445/2/22H; English translation, July 2025)SDAIA · checked
- Regulation on Personal Data Transfer outside the Kingdom, version 2.0 (August 2024)SDAIA · checked
- Rules for Appointing Personal Data Protection Officer, version 1.0 (August 2024)SDAIA · checked
- Draft amendments to the Implementing Regulation of the PDPL (public consultation, not in force)Istitlaa (public consultation platform) · checked
- Data Management and Personal Data Protection Standards, version 1.5National Data Management Office (SDAIA) · checked
- Essential Cybersecurity Controls (ECC-2:2024)National Cybersecurity Authority · checked
