Data Processing Agreement — KSA Personal Data Protection Law (PDPL)

When to use this

Use this skill when a Saudi-nexus data processing relationship requires a written DPA under the KSA Personal Data Protection Law (PDPL). The PDPL applies when:

• Personal data of Saudi residents or nationals is processed.
• A controller or processor is established in Saudi Arabia.
• Processing activities are directed at individuals in Saudi Arabia, regardless of the processor's location.

The instrument must be bilingual Arabic/English for SDAIA filings; Arabic controls.

For parallel GDPR requirements (e.g., a Saudi processor handling data on behalf of a European controller), use this skill alongside [[draft-dpa-gdpr]].

Regulatory framework