Statutory Privacy ยท SDAIA Mandate

Saudi PDPL on Microsoft 365

Technical Implementation Guide for the Personal Data Protection Law

The Personal Data Protection Law (PDPL), supervised and enforced by the Saudi Data & AI Authority (SDAIA), establishes the statutory framework for privacy and personal data protection across the Kingdom of Saudi Arabia. The law governs how personal data is collected, processed, stored, shared, and destroyed, carrying substantial administrative penalties for non-compliance.

While legal grounds for processing, privacy notices, and regulatory registrations belong to your legal team and Data Protection Officer (DPO), the operational duty to secure personal data against unauthorized disclosure, locate it on demand, and enforce cross-border boundaries requires precise technical controls. PolicySecOps configures and documents these technical mechanisms inside your Microsoft 365 environment.

Standing Disclaimer

We configure and document the technical controls inside your Microsoft environment. We are not an auditor or certification body and we don't give legal advice. Meeting a regulation also depends on policies, people and physical controls that stay with your organisation.

Licence Dependency Notice

What we can switch on depends on the Microsoft licences you already have. The assessment shows you exactly what is possible today and what would need an extra licence. We don't sell licences, so we have nothing to push.

Applicability Matrix

Who Saudi PDPL Is For

The Saudi PDPL applies to any entity that processes personal data relating to individuals residing in the Kingdom:

01

Public Sector & Ministries

Government ministries, authorities, and state institutions processing citizen and resident personal records.

02

Commercial Enterprises

Retailers, financial institutions, fintechs, and telecommunications firms managing high-volume consumer customer datasets.

03

Healthcare & Insurance

Hospitals, medical networks, pharmaceutical firms, and health insurers handling sensitive health data requiring heightened protection.

04

Multinationals & Overseas Entities

Foreign enterprises operating outside the Kingdom that process data, market services to, or monitor individuals residing in Saudi Arabia.

Demarcation of Responsibility

Audit Scope Breakdown

Microsoft Purview technical compliance capabilities versus statutory responsibilities managed by your Data Protection Officer and legal counsel.

Technical Engineering

What We Help You Put in Place

We implement the technical privacy, data discovery, security, and response capabilities available natively in Microsoft Purview and Microsoft Entra ID:

Area 1

Automated Discovery of Saudi Personal Data

  • Regional Sensitive Data Classifiers: We activate and fine-tune classifiers designed specifically for Saudi identifiers across your mailboxes, cloud files, and collaboration channels. This includes Saudi National ID numbers, Iqama resident IDs, Saudi IBAN numbers, passport numbers, commercial registration records, Saudi mobile numbers, and health records.
  • Repository Data Mapping: We configure automated content exploration across Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams to give your DPO a clear picture of exactly where personal data resides across your organisation.
Area 2

Leakage Prevention and Unauthorised Disclosure Blocks

  • External Transmission Blocks: We deploy data loss prevention policies that detect Saudi personal records and block unauthorized attempts to email them to external recipients, paste them into web chats, or upload them to personal cloud storage.
  • Endpoint Leakage Barriers: We configure controls on corporate workstations that intercept and block copying sensitive personal data to unapproved USB flash drives, network shares, or clipboard memory.
  • Application Access Fencing: We implement session controls that block downloading files containing personal data when staff connect from unmanaged personal devices or unverified network locations.
Area 3

Cross-Border Data Transfer Controls

  • Data Residency Configuration: We verify that your tenant services and cloud storage reside within regional cloud boundaries to maintain sovereign storage requirements.
  • Cross-Border Transfer Restrictions: We configure transfer prevention policies that detect and block the automatic synchronization, forwarding, or sharing of personal data outside approved jurisdictions without documented compliance approvals.
Area 4

Thirty-Day Data Subject Request (DSR) Workflows

  • Targeted Individual Discovery: When an individual exercises their statutory right to access, obtain a copy of, or request the destruction of their personal data, your team needs to locate all relevant records across unstructured repositories within thirty days.
  • Rapid Search and Review: We configure eDiscovery workflows that query mailboxes, cloud drives, and chat histories simultaneously using individual identifiers, allowing compliance officers to review, redact, and export personal data records within minutes.
  • Defensible Destruction Actions: We establish procedures to execute targeted, verifiable deletion of personal data files upon validated erasure requests.
Area 5

Automated Retention and Purpose-Expiry Disposal

  • Lifecycle Retention Schedules: We implement retention policies that automatically retain personal records for legally mandated operational periods, preventing premature deletion during ongoing contractual relationships.
  • Automated Purpose-Expiry Purging: Once the legitimate processing purpose has expired, automated policies initiate disposition workflows to securely purge expired records, generating tamper-proof disposal logs that demonstrate compliance.
Area 6

Seventy-Two-Hour Breach Investigation Telemetry

  • Rapid Forensic Discovery: In the event of an alleged data incident, the PDPL requires notifying SDAIA within seventy-two hours of becoming aware of a breach that compromises personal data.
  • Granular Audit Trails: We configure comprehensive audit logging that records file downloads, mailbox accesses, external link shares, and administrative modifications.
  • Incident Impact Reporting: When an incident occurs, our configured search queries enable your incident response team to extract the exact list of compromised files, the count of exposed Saudi personal records, and the identities of affected data subjects within hours, providing the factual evidence needed for regulatory submissions.
Area 7

Governance Roles for Data Protection Officers

  • Least-Privilege Privacy Administration: We configure dedicated administrative roles in Microsoft Purview for your DPO and compliance team, granting full visibility over personal data maps, data loss alerts, and retention dashboards without granting unnecessary IT or operational control.
DPO & Legal Scope

What Stays With Your Organisation

Technical configurations provide essential safeguards, but full alignment with the PDPL requires legal, operational, and administrative measures managed by your internal leadership and DPO:

Lawful Basis Determination

Identifying and documenting the legal grounds for each processing activity, such as statutory obligations, contractual necessity, or explicit data subject consent.

External Privacy Notices

Drafting and publishing clear, bilingual (Arabic and English) privacy notices, collection forms, and cookie policies for customer-facing touchpoints.

Record of Processing Activities (RoPA)

Creating and maintaining the formal, legal RoPA document detailing processing categories, recipient entities, retention justifications, and international transfers.

Data Protection Impact Assessments (DPIAs)

Conducting formal written risk assessments prior to launching processing activities involving sensitive personal data, automated profiling, or large-scale processing.

Appointing & Registering the DPO

Selecting a qualified Data Protection Officer and completing official registration on the SDAIA National Data Governance Platform.

Transfer Impact Assessments

Drafting standard contractual clauses, binding corporate rules, and legal transfer assessments for international data transfers.

Regulatory Communications

Managing formal communications, dispute responses, and statutory breach notifications directly through official SDAIA portals.

Engagement Outputs

Technical Deliverables You Receive

Following a PDPL implementation engagement, your organisation receives defensible technical configurations and runbooks:

Asset 01

Configured Saudi Personal Data Classifiers

Tailored detection patterns active across your Microsoft tenant for Saudi personal identifiers and sensitive categories.

Asset 02

Enforced Data Protection Policies

Active data loss prevention rules blocking unauthorized external sharing, endpoint copying, and cross-border data leakage.

Asset 03

DSR & Breach Search Runbooks

Step-by-step technical procedures for handling thirty-day data subject requests and seventy-two-hour breach forensic extractions.

Asset 04

Complete Engineering Documentation

As-built documentation covering all configured policies, administrative roles, and disposition workflows.

Privacy Engineering Assessment

Prepare Your Microsoft 365 Tenant for Saudi PDPL

We evaluate your current subscriptions and repositories to map out the technical data discovery and protection controls needed to meet PDPL requirements.

Request a Scoped Proposal