PDPL Article 18 Accountability: What SDAIA Inspections Verify
Article 18 of the Personal Data Protection Law establishes the accountability principle: controllers must take appropriate measures to demonstrate compliance with the law. Unlike prescriptive frameworks that enumerate specific controls, PDPL Article 18 accountability SDAIA inspection requirements are outcome-based. The Saudi Data and Artificial Intelligence Authority expects controllers to prove, through documented measures, that they meet their obligations under the law. For data protection officers and legal counsel preparing for SDAIA inspections, the question is not whether to demonstrate compliance, but which documented measures inspectors will request and what content those measures must contain.
SDAIA inspection reports and enforcement decisions reveal a consistent pattern. Inspectors begin with seven categories of documented measures, each corresponding to a substantive obligation under the PDPL. Controllers that cannot produce these records on request face findings of non-compliance with Article 18, regardless of whether their actual processing practices are lawful. This guide identifies those seven measures, explains the minimum content SDAIA expects for each, and describes the retention periods that satisfy inspection requirements.
The Seven Documented Measures SDAIA Requests First
SDAIA inspections follow a structured methodology. Inspectors request documentary evidence in a predictable sequence, beginning with foundational records that demonstrate the controller understands what personal data it holds and why. The seven measures appear in nearly every inspection report:
1. Data inventory — A structured record of all personal data categories the controller holds, including special categories of personal data as defined in Article 4 of the PDPL. SDAIA expects the inventory to identify the data subject categories, the source of the data, and the storage location. Controllers that process personal data across multiple systems or departments must maintain a consolidated inventory, not separate records that require manual aggregation during an inspection.
2. Processing register — A register of processing activities that documents, for each processing purpose, the legal basis under Article 6, the data categories processed, the recipients or categories of recipients, and the retention period. SDAIA enforcement decisions show that vague entries such as "business purposes" or "legitimate interest" without further specification result in findings of non-compliance. The register must specify the exact purpose and cite the applicable legal basis.
3. Consent records — Where the controller relies on consent as the legal basis for processing, SDAIA requires documented evidence that consent was freely given, specific, informed, and unambiguous, as Article 6 requires. Inspectors verify that consent records capture the date, the specific purpose disclosed to the data subject, and the affirmative action taken. Pre-ticked boxes, bundled consent for multiple purposes, and consent inferred from silence do not satisfy the standard.
4. Breach log — A chronological record of all personal data breaches, including those that did not meet the threshold for notification to SDAIA or data subjects under Article 26. The log must document the date of discovery, the nature and extent of the breach, the affected data subjects, the measures taken to contain the breach, and the rationale for any decision not to notify. SDAIA inspections frequently request breach logs for the preceding 24 months.
5. Data Protection Impact Assessments — For processing activities that pose high risk to the rights and freedoms of data subjects, Article 27 requires a DPIA before processing begins. SDAIA expects the assessment to identify the specific risks, evaluate their likelihood and severity, and document the measures implemented to mitigate those risks. Controllers that conduct DPIAs only after processing has commenced, or that produce generic assessments not tailored to the specific processing activity, face findings of non-compliance.
6. Processor agreements — Written contracts with processors that meet the requirements of Article 10, including the subject matter and duration of processing, the nature and purpose of processing, the type of personal data, the obligations and rights of the controller, and the processor's obligation to implement appropriate technical and organizational measures. SDAIA enforcement decisions confirm that unsigned agreements, agreements that predate the processing activity, or agreements that omit mandatory clauses result in findings of non-compliance with both Article 10 and Article 18.
7. Training records — Evidence that personnel who process personal data have received training on the PDPL and the controller's internal policies. SDAIA expects training records to identify the employees trained, the date and duration of training, and the topics covered. Annual refresher training is the emerging standard, though the PDPL does not prescribe a specific frequency.
Minimum Content and Retention Periods
SDAIA does not publish detailed guidance on the content of each measure, but inspection reports and enforcement decisions reveal the minimum elements inspectors expect.
Data Inventory
The inventory must identify, for each category of personal data: the data subject category (e.g., employees, customers, website visitors); the specific data elements (e.g., national ID, email address, transaction history); the source (e.g., collected directly from data subject, obtained from third party); the storage location (e.g., HR system, CRM database, cloud storage provider); and the business unit or department responsible. Controllers that process special categories of personal data must flag those categories in the inventory. SDAIA expects the inventory to be reviewed and updated at least annually, and more frequently if the controller introduces new processing activities.
Processing Register
Each entry in the register must specify: the processing purpose in sufficient detail to demonstrate necessity and proportionality; the legal basis under Article 6 (consent, contract, legal obligation, vital interests, public interest, or legitimate interest); the data categories processed for that purpose; the recipients or categories of recipients, including processors and third-party controllers; the retention period or the criteria used to determine it; and, for cross-border transfers, the destination country and the transfer mechanism under Article 24. Controllers that rely on legitimate interest must document the balancing test. The register must be maintained for the duration of the processing activity and for 24 months after processing ceases.
Consent Records
For each instance of consent, the record must capture: the identity of the data subject; the date and time consent was obtained; the exact wording of the consent request presented to the data subject; the specific purpose or purposes for which consent was requested; the affirmative action taken (e.g., signature, checkbox selection, verbal confirmation recorded); and, if consent was withdrawn, the date of withdrawal and the cessation of processing. SDAIA expects consent records to be retained for the duration of processing and for 36 months after consent is withdrawn or processing ceases, to demonstrate compliance in the event of a complaint.
Breach Log
Each breach entry must document: the date the breach was discovered; the date the breach occurred, if different; the nature of the breach (e.g., unauthorized access, accidental disclosure, ransomware attack); the personal data affected; the number and categories of data subjects affected; the immediate containment measures taken; the root cause analysis; the corrective measures implemented to prevent recurrence; and, if the breach was not notified to SDAIA or data subjects, the documented rationale for that decision. SDAIA expects the breach log to be retained for at least 60 months.
Data Protection Impact Assessments
The DPIA must include: a description of the processing activity and its purposes; an assessment of the necessity and proportionality of the processing; an identification of the specific risks to data subjects' rights and freedoms; an evaluation of the likelihood and severity of each risk; the technical and organizational measures implemented to mitigate the risks; and, if residual risk remains high, evidence that SDAIA was consulted before processing commenced. DPIAs must be reviewed and updated when the processing activity changes materially or when new risks emerge. SDAIA expects DPIAs to be retained for the duration of the processing activity and for 24 months after processing ceases.
Processor Agreements
The agreement must be in writing, signed by both parties before processing begins, and must include all mandatory clauses required by Article 10. SDAIA inspections verify that the agreement specifies the subject matter, duration, nature, and purpose of processing; the type of personal data and categories of data subjects; the controller's instructions; the processor's obligation to implement appropriate security measures; the processor's obligation to engage sub-processors only with prior written authorization; the processor's obligation to assist the controller in responding to data subject requests; the processor's obligation to delete or return personal data at the end of the contract; and the processor's obligation to make available all information necessary to demonstrate compliance. Processor agreements must be retained for the duration of the processing relationship and for 60 months after the relationship ends.
Training Records
Training records must identify: the employees who received training; the date and duration of each training session; the topics covered, with specific reference to the PDPL and the controller's internal policies; the training method (e.g., in-person workshop, e-learning module, briefing session); and evidence of completion (e.g., attendance register, assessment score, certificate). SDAIA expects training to be provided to all personnel who process personal data, not only to data protection officers or compliance staff. Training records must be retained for the duration of employment and for 24 months after employment ends.
Common Gaps in Documented Measures
Controllers preparing for SDAIA inspections frequently discover gaps in their documented measures, even when their processing practices are otherwise compliant. The most common gaps include:
Incomplete inventories — Data inventories that cover only the primary business systems, omitting personal data held in email archives, shared drives, backup systems, or shadow IT. SDAIA expects the inventory to reflect all personal data the controller holds, regardless of where it resides.
Generic processing registers — Registers that describe processing purposes in broad terms without sufficient detail to demonstrate necessity, or that fail to specify the legal basis for each purpose. Controllers that process personal data for multiple purposes under different legal bases must document each purpose separately.
Undocumented consent — Controllers that rely on consent but cannot produce records showing that consent was freely given, specific, informed, and unambiguous. Consent obtained before the PDPL came into force may not meet the current standard and should be refreshed.
Reactive breach logs — Breach logs created only after SDAIA requests them, or logs that document only breaches that were notified to SDAIA. The PDPL requires controllers to maintain a record of all breaches, including those below the notification threshold.
Missing DPIAs — Controllers that have not conducted DPIAs for high-risk processing activities, or that conducted assessments after processing commenced. Article 27 requires the DPIA to be completed before processing begins.
Unsigned processor agreements — Agreements that were negotiated but never executed, or agreements that do not include all mandatory clauses required by Article 10. SDAIA enforcement decisions confirm that unsigned agreements do not satisfy the requirement for a written contract.
Ad hoc training — Training provided inconsistently, without documented records of who was trained and when. SDAIA expects controllers to demonstrate that training is systematic and that all relevant personnel have received it.
A Sensible Order of Work
Controllers that lack one or more of the seven documented measures should prioritize remediation in an order that reflects both SDAIA's inspection methodology and the dependencies between measures.
Begin with the data inventory. The inventory is the foundation for all other measures; you cannot complete a processing register, conduct a DPIA, or draft a processor agreement without first understanding what personal data you hold. Conduct a comprehensive data mapping exercise across all systems, departments, and storage locations. Engage business units to identify personal data held outside primary systems.
Next, complete the processing register. Use the data inventory to identify all processing purposes, then document the legal basis, data categories, recipients, and retention period for each. Where the legal basis is legitimate interest, document the balancing test. Where the legal basis is consent, verify that consent records exist and meet the PDPL standard.
Review and, if necessary, refresh consent records. For each processing activity that relies on consent, verify that you hold documented evidence of freely given, specific, informed, and unambiguous consent. Where consent was obtained before the PDPL came into force or does not meet the current standard, plan a consent refresh campaign.
Establish the breach log and populate it with any breaches that occurred in the preceding 24 months. If no breaches have been documented, confirm whether that reflects the absence of breaches or the absence of a detection and logging process. Implement a breach detection and response procedure that includes mandatory logging.
Conduct DPIAs for all high-risk processing activities identified in the processing register. Prioritize processing activities that involve special categories of personal data, large-scale profiling, or automated decision-making. Ensure that the DPIA is completed before processing begins for any new high-risk activity.
Review and, if necessary, remediate processor agreements. Identify all processors, verify that a written agreement is in place for each, and confirm that the agreement includes all mandatory clauses required by Article 10. Where agreements are missing or deficient, negotiate and execute compliant agreements before the next inspection.
Finally, implement systematic training and establish training records. Develop a training program that covers the PDPL, the controller's internal policies, and the specific obligations of personnel who process personal data. Deliver training to all relevant personnel and maintain records of completion. Plan annual refresher training.
How GRC Advisory Supports PDPL Accountability
Controllers that need ongoing support to build and maintain the documented measures SDAIA expects can engage structured advisory services. GRC Advisory is a governance, risk and compliance framework tailored to Saudi regulatory requirements including the PDPL. The service provides ongoing governance, risk and compliance expertise, on call for your team.
The engagement follows a four-phase process: onboard to understand your environment, obligations and priorities; plan to agree the quarter's focus and advisory hours; advise through ongoing reviews, briefings and meeting support; and report with a monthly advisory report and quarterly review. Deliverables include a monthly advisory report, regulatory change briefings, reviewed documents with recommendations, and a compliance posture dashboard. The service includes regulatory change monitoring and impact, policy and document review, regulator and audit meeting preparation, compliance posture tracking, and monthly advisory hours. The engagement is structured as a 12-month retainer and covers the PDPL alongside other Saudi frameworks including SAMA CSF, NCA ECC, and SAMA CRFR.
For controllers preparing for SDAIA inspection, the service provides document review with recommendations to ensure that data inventories, processing registers, consent records, breach logs, DPIAs, processor agreements, and training records meet the minimum content and retention standards SDAIA expects. The compliance posture dashboard tracks the completeness of documented measures and flags gaps before they become inspection findings.
