Does PDPL apply to us if our cloud is outside Saudi Arabia?

The law follows the personal data of individuals in Saudi Arabia, so hosting abroad does not remove the obligation. It adds one: the transfer itself has to be controlled and justified.

Can we anonymise our way out of scope?

Only if the result genuinely cannot be re-identified, directly or by combination with another dataset you hold. In warehouses that condition usually fails, because a joinable key survives somewhere.

Where do most teams fail a review?

On deletion and on copies. The source record is removed while extracts, reporting marts and analyst sandboxes keep the same person alive under a different key.

Do you certify us as PDPL compliant?

No. Nobody in our position can. We build the controls and produce the evidence, and your legal and compliance functions make the determination.

Can AI models be trained on personal data?

Only under a lawful basis for that purpose, and the model then inherits the obligation. In practice we keep personal data out of training and bring it in at inference under access control.

Personal data

PDPL in practice: what the Personal Data Protection Law asks of your data platform

The law is written for the organisation, not for the warehouse. This page translates it into the tables, controls and evidence an engineering team has to produce.

Book the Data Foundation Assessment AI governance practice

Most gaps we find are not legal gaps. They are missing lineage, missing classification and copies nobody owns.

PDPLSDAIANDMO

The short answer

Saudi Arabia's Personal Data Protection Law governs how personal data of individuals in Saudi Arabia is collected, processed, stored and transferred. SDAIA supervises it. For a data platform this means a lawful basis per processing purpose, a record of what personal data exists and where, honoured data subject rights, controlled cross border transfer, and evidence you can produce on request.

Key takeaways

What you need to know, in a minute

Scope follows the individual, not the server

If the personal data belongs to someone in Saudi Arabia, the law applies to the processing wherever it happens. Offshore analytics does not move you out of scope.

Purpose is the unit of control

Every processing purpose needs its own lawful basis, retention and access rule. A single blanket policy across the warehouse will not survive a review.

Rights requests are an engineering problem

Access, correction, deletion and portability all require you to find every copy of a person's record across systems. That is lineage work before it is legal work.

Evidence beats intent

A policy document proves nothing on its own. What holds up is a log: who accessed what, under which purpose, and what was deleted when.

From the text to what gets built

Each line is a published expectation and what we implement against it. None of this is legal advice or a compliance verdict.

Area	What it asks for	What we build
Lawful basis and purpose	Process personal data only for a declared, legitimate purpose.	Purpose tags on datasets and pipelines, enforced at query time rather than written in a document.
Record of processing	Know what personal data you hold, where it sits and who processes it.	Automated classification and a lineage graph from source system to report, refreshed with the pipeline.
Data subject rights	Answer access, correction, deletion and portability requests.	A subject lookup that resolves one person across every system, with a deletion path that reaches derived tables and backups.
Minimisation and retention	Keep only what the purpose needs, only for as long as it needs it.	Retention rules attached to the dataset, with expiry jobs and a record of what they removed.
Transfer outside Saudi Arabia	Control and justify any transfer of personal data abroad.	Residency policy per data class, enforced in the platform so an offshore service cannot silently read a restricted table.
Breach handling	Detect, assess and notify when personal data is exposed.	Access anomaly alerts tied to the classification, so the blast radius of an incident is a query rather than a guess.

Personal data discovery

Scan source systems, lakes and the copies nobody documented, then classify what is personal, sensitive or neither.

Rights fulfilment pipeline

One request in, a resolved subject record out, with deletion propagating to derived tables instead of stopping at the source.

Residency enforcement

Policy per data class in the platform layer, so which workloads may run where stops depending on who remembers.

Evidence pack

The logs, lineage and control reports a reviewer asks for, generated from the platform rather than assembled by hand.

Use cases

Where this applies in practice

Questions we get on PDPL

Related guides

NDMO controls

An assessment score moves when the catalogue is populated by the pipeline, not by a spreadsheet campaign.

Open the guide

SDAIA alignment

The ethics principles are not decoration. They decide which decisions a model is allowed to make alone.

Open the guide

NCA Essential Cybersecurity Controls

Most audit findings on a data platform are access findings. Shared accounts and forgotten service credentials, not exotic attacks.

Open the guide

SAMA expectations

The question is rarely whether the model works. It is whether you can reconstruct one decision from eighteen months ago.

Open the guide

In-country hosting

The failure is almost never the main database. It is a notebook, a support tunnel or a model API nobody classified.

Open the guide

Etimad

A bid rarely loses on the model. It loses on the appendix nobody prepared.

Open the guide

Let's put your AI ambition on the table

Sixty minutes with a senior Bilytica partner. We stress-test your plans against what actually works in your sector, agree which moves are worth funding first, and you leave with a written 90-day plan and honest numbers, whether you work with us or not.

Start the conversation