Applicability
Establish which authorities apply, for which data classes and which processing activities.
Done when: A written applicability statement exists per authority.
Saudi Data Compliance Framework (SDCF)
Saudi Data Compliance Framework
NDMO, PDPL, NCA, SAMA and SDAIA ethics folded into one control set with evidence per control.
The business problem
Every regulator asks the same questions in a different format.
NDMO, PDPL, NCA and SAMA each trigger their own project, and the same evidence is gathered again and again.
What you hear inside the organisation
We just finished the NDMO review and now NCA wants the same.
Where exactly is our personal data?
Compliance lives in spreadsheets.
Who signs off this evidence?
Who it serves and what changes
Your teams, before and after the Saudi Data Compliance Framework
Client teams and what they need
Compliance and risk
One control set for every regulator
Data office
Controls inside the data, not beside it
Cybersecurity
NCA controls tied to data assets
Internal audit
Evidence that is always current
The outcome you get
- One control library mapped to every Saudi regulator
- Personal data discovered and classified
- Evidence collected once, reused for every review
- A clear owner for every control
A worked example
A financial company regulated by SAMA, NDMO and NCA
The problem we saw
Each review was a separate project. Teams rebuilt the same evidence in spreadsheets, and nobody was sure where personal data sat.
How the framework solved it
We discovered and classified personal data, merged every regulator's requirements into one control set, and linked each control to live evidence.
The business result
The next review drew on the same evidence pack, owners knew their controls, and compliance stopped being a yearly scramble.
Illustrative example based on common client situations.
In short
What is the Saudi Data Compliance Framework?
Saudi Data Compliance Framework (SDCF): NDMO, PDPL, NCA, SAMA and SDAIA ethics folded into one control set with evidence per control.
Saudi organisations answer to several authorities that ask overlapping questions in different formats.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Run by compliance and data governance with legal; signed off by the accountable executive for data protection.
- You keep
- Unified control set, Evidence index, Attestation pack
How it works
How the Saudi Data Compliance Framework works
Regulations change; the control set is versioned so a new circular is a diff, not a restart.
Unified controls
Merge overlapping requirements into one control per obligation, cited to each source.
Done when: The same duty is implemented twice in two languages of compliance.
Evidence
Attach the artefact that proves each control, produced by a system rather than a statement.
Done when: Every control has an artefact with a date and a source system.
Gap & remediation
Score each control, rank the gaps by exposure, and assign an owner and a date.
Done when: Every high-exposure gap has a dated remediation owner.
Attest & refresh
Produce the attestation pack and re-run the control set on a fixed cycle.
Done when: The pack can be handed to a reviewer without preparation work.
Is it right for you?
Is the Saudi Data Compliance Framework right for you?
A strong fit if
- You answer to more than one Saudi regulator
- Reviews consume heavy manual evidence work
- You hold personal or classified data
Probably not yet if
- You face a single, light regulatory requirement
- You need a legal opinion rather than operating controls
Free assessment
Discuss the Saudi Data Compliance Framework with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Saudi Data Compliance Framework in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
Saudi organisations answer to several authorities that ask overlapping questions in different formats. SDCF states each obligation once, maps it to every authority that asks for it, and names the evidence that satisfies all of them together.
Version
v1.0
Last reviewed
August 2026
Family
Saudi Data & AI Standards
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
Unified control set
One control per obligation with citations to every authority that requires it.
Evidence index
A dated artefact per control, produced by the system that runs it.
Attestation pack
Reviewer-ready, versioned, and refreshed on a fixed cycle.
Banking & finance
SAMA expectations sit above the base set; outsourcing and cloud controls are examined first.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Applicability
- Applicability statement
- Processing register
2
Unified controls
- Unified control set
- Source citation table
3
Evidence
- Evidence index
- Screenshot and export pack
4
Gap & remediation
- Gap register
- Remediation plan
5
Attest & refresh
- Attestation pack
- Refresh calendar
Regulations change; the control set is versioned so a new circular is a diff, not a restart.
Stage
Exit gate
Artefacts
1
Applicability
Establish which authorities apply, for which data classes and which processing activities.
Exit gate
A written applicability statement exists per authority.
Artefacts
- Applicability statement
- Processing register
2
Unified controls
Merge overlapping requirements into one control per obligation, cited to each source.
Exit gate
The same duty is implemented twice in two languages of compliance.
Artefacts
- Unified control set
- Source citation table
3
Evidence
Attach the artefact that proves each control, produced by a system rather than a statement.
Exit gate
Every control has an artefact with a date and a source system.
Artefacts
- Evidence index
- Screenshot and export pack
4
Gap & remediation
Score each control, rank the gaps by exposure, and assign an owner and a date.
Exit gate
Every high-exposure gap has a dated remediation owner.
Artefacts
- Gap register
- Remediation plan
5
Attest & refresh
Produce the attestation pack and re-run the control set on a fixed cycle.
Exit gate
The pack can be handed to a reviewer without preparation work.
Artefacts
- Attestation pack
- Refresh calendar
Standard
What this framework satisfies
NDMO
Data management and personal data protection specifications, evidenced per domain.
PDPL
Lawful basis, notice, subject rights, transfer conditions and retention.
NCA
Essential and cloud cybersecurity controls relevant to data handling.
SDAIA
AI ethics principles carried through as controls, not statements of intent.
ISO/IEC 42001
Provides the management-system wrapper the Saudi controls sit inside.
One project per regulator
Parallel programmes produce contradictory evidence. Implement once, cite many.
Policy-only compliance
A signed policy with no system artefact will not survive a review.
Evidence gathered at review time
Evidence assembled in a panic is evidence of an unmanaged control.
Saudi control self-check
A short readiness check against the obligations reviewers ask about first.
0%Unevidenced0/10
Most statements have no artefact behind them. Start with one domain and produce the evidence before widening scope.
Scoring is deterministic and runs entirely in your browser. Nothing is stored or sent.
Built on
- 1
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
- 2
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
- 3
NCA Essential and Cloud Cybersecurity Controls
National Cybersecurity Authority control catalogues.
- 4
SAMA frameworks for cybersecurity and outsourcing
Supervisory expectations for financial institutions.
- 5
SDAIA AI Ethics Principles
Saudi Data & AI Authority, national principles for AI.
- 6
ISO/IEC 42001: AI management systems
International Organization for Standardization, management system requirements for AI.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
Written for Saudi Arabia, not adapted to it
This family exists because the Saudi control set, Arabic quality and the in-country deployment ruling are not add-ons to a global method. They decide whether a system is allowed to run at all.
AuthorityWhat it requiresWhat we buildWhat you keep
SDAIA, PDPL
National AI ethics principles applied as testable controls.
Each principle becomes a check with a pass condition and a named reviewer.
Ethics review record per release, in Arabic.
Arabic quality standard
Saudi Arabic output has to be correct in register, terminology and numerals, in front of a customer.
Arabic evaluation sets built from Saudi content, scored before release.
Arabic quality score with the failing cases attached.
NCA ECC
Deployment location and network boundaries are a documented decision.
A deployment ruling per data class states what may leave Saudi Arabia and what may not.
Signed residency ruling referenced by the architecture record.
Where it runs
The default is in-country, in your environment. Any exception is written down with the data class, the reason and an expiry date.
Arabic, as it is spoken here
Arabic is the governing version of every artefact in this family, with English supplied alongside.
FAQ
Frequently Asked Questions
Does this replace an NDMO assessment?
No. It prepares for it. The same evidence index answers the assessment without a separate exercise.
How do you handle regulatory change?
The control set is versioned. A new circular produces a change list against the previous version.
Can it cover AI systems specifically?
Yes, the AI-specific obligations are carried by the AI Assurance Framework, which reuses this control set as its Saudi layer.
Where this connects
Rest of the library
DFFData Foundation FrameworkAIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkAGENTAgent Operations FrameworkSOVEREIGNSovereign AI FrameworkDMMData Management Maturity ModelDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkDGOVData Governance Operating ModelAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.