ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Saudi PDPL data subject rights decide how quickly and how completely your organization must respond when a person in Saudi Arabia asks what you hold about them. Under the Personal Data Protection Law (PDPL) and its Implementing Regulations, individuals can ask to be informed, to see and copy their data, to have it corrected, to have it destroyed and to withdraw consent. This guide explains each right, the response timing that commentators report, and how to build a workflow that an SDAIA review would find credible.
Article numbers and exact deadlines should be checked against the current Arabic text and the latest Implementing Regulations, because most English commentary is secondary. Our overview of the Saudi PDPL gives the wider context, and the Implementing Regulations guide covers the supporting rules.
Free gap assessment
Could you demonstrate GDPR compliance today?
Score yourself against what a supervisory authority actually asks for, free — the records, not the policy.
Run the free GDPR gap assessment → or View premium report sample
Law-firm summaries group the rights into five practical categories. The table shows what each means for a controller.
| Right | What the individual can ask | What you must do |
|---|---|---|
| Be informed | Why and on what basis data is collected | Give a clear, explicit purpose and legal basis at collection |
| Access and copy | See and receive their data | Provide it in a readable, commonly used electronic format |
| Correction | Fix inaccurate data | Correct it, and restrict processing while accuracy is checked |
| Destruction | Have data deleted | Destroy it when the purpose is fulfilled or processing is unlawful |
| Withdraw consent | Stop consent-based processing | Cease processing without undue delay |
These are the Saudi PDPL data subject rights your procedures must cover. A privacy notice that promises them is not enough. You need a working process behind each one.
Commentary on the Implementing Regulations says controllers must give individuals the prescribed information using necessary measures, including the legal basis and a specific, clear and explicit purpose. Where data is collected directly, the information is due at collection. Where it is collected indirectly, it should follow without undue delay and, according to one law-firm summary, within 30 days. Exceptions apply where the person already has the information or where providing it would conflict with other laws of the Kingdom.
In practice this lives in your privacy notice. Our guide to the Saudi PDPL privacy policy lists what to include. Make sure the notice matches what your systems really do, because a purpose stated in the notice becomes the boundary for your processing.
A PDPL access request gives the individual the right to see their data and receive a copy. Commentators report that the copy must be in a readable, clear and commonly used electronic format, and that a hard copy should be offered where feasible. One important safeguard: when you disclose data, you must not reveal the identities of other individuals.
Confirm the requester is who they claim to be before releasing anything, but ask for the minimum needed. Requesting a full passport scan to answer a low-risk query creates a new data protection problem. Match against details you already hold where possible, and record how you verified.
Records often contain other people’s names, such as colleagues in an email thread or family members on a form. Build redaction into your export step, and have a second person review sensitive cases before release.
If a person disputes the accuracy of their data, the Implementing Regulations, as summarized by commentators, allow you to restrict processing while you verify, and to ask for supporting evidence. Correct the record once confirmed, and pass the correction to recipients who received the wrong data.
Destruction applies when the purpose is fulfilled, the data is no longer necessary or the processing is unlawful. It is not automatic in every case, because retention duties under other Saudi laws may require you to keep records. Document any refusal with the specific reason, and tell the individual. Destruction also needs a procedure: identify every system, backup and processor copy, and record when each was cleared.
Where consent is your legal basis, withdrawal must be as easy as giving it. Commentators say processing must stop without undue delay after withdrawal. Design the mechanism first, for example an account setting or an email address monitored daily, and update marketing lists and downstream processors the same day where you can.
Secondary sources report that controllers must act on requests within 30 days, with a possible further 30-day extension in certain circumstances such as multiple requests. Treat 30 days as your planning limit, and confirm the exact timing and the grounds for extension in the current regulations before you publish an internal service level.
This is a good place to link the process to your registration and breach procedures. See SDAIA registration and breach notification, and use the PDPL compliance checklist to test overall readiness.
Most failures in request handling start with the front line, not the privacy team. A customer service agent who does not recognise a deletion request buried in a complaint email has already put the deadline at risk. Give frontline staff a one-page guide that shows what a request looks like, where to forward it and how quickly. Refresh it whenever the process changes, and test it with a mock request each year.
Also brief your processors. If a cloud or marketing provider holds personal data on your behalf, your contract should oblige it to help with requests and to respond to you within a set number of days, so that you can meet your own timeline. Keep a contact list for each processor, and test that the contact answers.
Each PDPL access request should leave a short file: the original message, the verification record, the search results by system, the redaction decisions, the response sent and the date. Keep these for a period set by your retention schedule. If the regulator asks how you handled a complaint, this file is your defence.
A hypothetical Riyadh retailer receives an email asking for all data held on a customer and for the deletion of her marketing profile. The privacy lead logs the request, verifies identity using the account email and a one-time code, and searches the CRM, the loyalty platform and the email provider. The export omits a colleague’s comments on a complaint record. The retailer sends the copy in a common electronic format within the month, deletes the marketing profile, keeps the invoices it must retain for tax reasons, and explains that in writing. This example is invented for illustration only.
Read the primary sources as well as summaries. The law-firm analysis by Akin Gump on the PDPL and Implementing Regulations is a useful starting point, but it is not a substitute for the official text.
To avoid drafting request forms, response letters and logs from scratch, the Saudi PDPL Toolkit provides ready-made documents you can adapt. Have counsel confirm the wording against the current law before use.
Secondary sources report 30 days, extendable by a further 30 days in certain cases. Confirm the current rule in the Implementing Regulations.
The sources reviewed do not state a fee position, so do not assume you can charge. Check the regulations and any SDAIA guidance first.
No. Destruction applies in defined cases such as the purpose being fulfilled or unlawful processing. Other legal retention duties may apply, and refusals need recorded reasons.
No. You must not disclose the identities of other individuals, so redact them before releasing a copy.
Assign a named owner, usually the data protection lead, with a backup. Keep a log so you can show how each request was handled.
September 30, 2026
