Analysis of Saudi regulatory developments and practical guidance for security and risk leaders.
Four retailers assumed marketing-unsubscribe workflows satisfied PDPL consent-withdrawal rights, but SDAIA inspections revealed a critical gap. Unsubscribe stops messages; lawful withdrawal requires deletion or anonymization of the underlying personal data.
Most AML projects focus on vendor features, not SAMA's risk-based expectations. Drawing from twelve remediation engagements, this article identifies the recurring gaps and the implementation sequence that passes regulatory scrutiny.
Generic threat-intelligence feeds list tactics and indicators, but boards need to know which business assets are at risk. This article shows the three-step method three Jeddah firms used to map threat actors to critical systems, turning abstract intelligence into prioritised control investments.
Three Saudi banks discovered their screening tools failed on transliteration, diacritics and name-order variations. Here are the four fuzzy-matching parameters to test before your next SAMA inspection.
Most banks combine cyber oversight with enterprise risk, but two institutions found this diluted both agendas and slowed incident escalation. This article shows the three triggers that justify separate committees, the charter clauses that changed, and the reporting-line adjustments that preserved board efficiency.
Answer a few questions for your framework. You get a score, your biggest gaps and — if you want it — a detailed assessment from our team.
Tell us where you stand. We will show you the shortest path to what your regulator expects.
SAMA, NCA and SDAIA changes and what they mean for your institution — once a month.
↑↓ to move↵ to openEsc to close
