Organizations operating in the Kingdom routinely transfer personal data across borders: employee records to regional payroll systems, customer data to cloud providers in Europe, transaction logs to parent companies abroad. Each of these flows falls within the scope of Article 23 of the Personal Data Protection Law, which permits cross-border transfers only when adequate safeguards exist to protect the data once it leaves Saudi jurisdiction. The challenge for Data Protection Officers and Legal Counsel is that the PDPL cross-border data transfer requirements do not prescribe a single compliance path, nor does the regulation define what constitutes an adequate safeguard in operational terms.
The Saudi Data and Artificial Intelligence Authority expects organizations to document the legal basis for every cross-border flow and to retain evidence that the chosen safeguard meets the standard set by the law. In practice, SDAIA inspections verify five categories of documented measures. This guide lists each, explains what the regulator looks for, and sets out the retention requirements that accompany them.
The Five Documented Safeguards
1. Adequacy Decisions
An adequacy decision is a formal determination by SDAIA that a foreign jurisdiction provides a level of data protection substantially equivalent to that required under the PDPL. When such a decision exists, transfers to that jurisdiction proceed without additional safeguards.
What SDAIA expects: A copy of the published adequacy decision, filed with the organization's records of processing activities, and a documented review process to monitor whether the decision remains in force.
Retention: Maintain the adequacy decision and the date of your last review for the duration of the transfer arrangement plus three years.
Current state: At the time of writing, SDAIA has not published a list of jurisdictions deemed adequate. Organizations should monitor SDAIA announcements and, in the absence of an adequacy decision, rely on one of the four remaining safeguards.
2. Standard Contractual Clauses
Standard contractual clauses are template agreements that impose data protection obligations on the foreign recipient equivalent to those the PDPL imposes on the data controller in the Kingdom. The clauses bind the recipient to process data only as instructed, implement appropriate security measures, notify the controller of breaches, and permit audits.
What SDAIA expects: A signed agreement incorporating the standard clauses, annexed to the main commercial contract or executed as a standalone data processing addendum. The clauses must be tailored to identify the parties, the categories of data transferred, the purpose of the transfer, and the technical and organizational measures the recipient will apply. SDAIA expects to see evidence that the recipient has acknowledged these obligations in writing.
Sample clause structure:
- Parties and roles: Identify the data controller in the Kingdom and the data processor or sub-processor abroad.
- Scope of processing: Describe the categories of personal data, the purposes for which the recipient may process them, and the duration of processing.
- Security obligations: Require the recipient to implement measures appropriate to the risk, including encryption in transit and at rest, access controls, and incident response procedures.
- Sub-processing: Prohibit onward transfers without prior written consent and require the recipient to impose equivalent obligations on any sub-processor.
- Audit rights: Reserve the right to audit the recipient's compliance, either directly or through an independent auditor, on reasonable notice.
- Breach notification: Require the recipient to notify the controller without undue delay upon discovering a personal data breach.
- Termination and return: Obligate the recipient to return or destroy all personal data upon termination of the agreement, with certification of deletion.
Retention: Retain the signed clauses for the duration of the transfer arrangement plus ten years. Retain audit reports and breach notifications for the same period.
3. Binding Corporate Rules
Binding corporate rules are internal policies adopted by multinational organizations to govern intra-group transfers of personal data. They establish a uniform standard of protection across all entities within the corporate group, regardless of where each entity is located.
What SDAIA expects: A board-approved policy document that sets out the rules, identifies the entities bound by them, describes the data protection principles each entity must observe, and establishes an internal enforcement mechanism. The rules must be legally binding on each entity—typically through incorporation into local employment contracts, service agreements, or corporate bylaws.
Key elements:
- Scope: List the entities covered and the categories of personal data subject to the rules.
- Principles: Commit each entity to lawful processing, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability.
- Data-subject rights: Establish a single point of contact for data-subject requests and a process for handling them across the group.
- Complaints and redress: Provide a mechanism for individuals to lodge complaints and seek redress, including the right to bring claims before a competent authority or court.
- Cooperation with SDAIA: Commit to cooperate with SDAIA inquiries and inspections, and to provide documentation upon request.
Retention: Retain the current version of the binding corporate rules and all superseded versions for ten years after they cease to apply. Retain records of internal audits and complaints for the same period.
4. Explicit Consent Records
In the absence of an adequacy decision, standard contractual clauses, or binding corporate rules, an organization may transfer personal data abroad if the data subject has given explicit consent to the transfer after being informed of the risks.
What SDAIA expects: A consent record that demonstrates the individual was informed of the specific transfer, the destination country, the absence of an adequacy decision, and the possible risks to their data. The consent must be freely given, specific, informed, and unambiguous. SDAIA expects to see evidence that the individual took a clear affirmative action—such as ticking an unticked box or signing a statement—and that consent was not bundled with acceptance of general terms and conditions.
Sample consent language:
*"I consent to the transfer of my personal data to [Recipient Name] in [Country], for the purpose of [Purpose]. I understand that [Country] has not been recognized by SDAIA as providing adequate data protection, and that my data may not be subject to the same level of protection as it receives in the Kingdom of Saudi Arabia. I understand the risks of this transfer and consent to it nonetheless."*
Retention: Retain the consent record for the duration of the transfer plus ten years. Retain evidence of the information provided to the individual at the time consent was sought, including the date, the method of consent capture, and any accompanying disclosures.
Limitations: Consent is not a practical safeguard for routine, high-volume transfers such as cloud hosting or payroll processing. It is best suited to one-off transfers initiated at the request of the individual, such as a request to forward data to a foreign service provider.
5. Necessity Justifications
Article 23 permits transfers without additional safeguards when the transfer is necessary for one of several enumerated purposes: performance of a contract with the data subject, conclusion or performance of a contract in the data subject's interest, establishment or defense of legal claims, protection of vital interests, or performance of a task carried out in the public interest.
What SDAIA expects: A documented justification that explains why the transfer is necessary—not merely convenient or cost-effective—and that demonstrates the organization considered less intrusive means of achieving the same purpose. The justification must be specific to the transfer in question; a blanket assertion of necessity across all transfers will not suffice.
Sample justification structure:
- Purpose: State the specific purpose for which the transfer is required.
- Necessity: Explain why the transfer is objectively necessary to achieve that purpose, and why it cannot be achieved by processing the data within the Kingdom or in a jurisdiction subject to an adequacy decision.
- Proportionality: Describe the measures taken to limit the transfer to the minimum data necessary and to minimize the duration of storage abroad.
- Alternatives considered: Document the alternative means considered and the reasons they were not feasible.
Retention: Retain the necessity justification for the duration of the transfer plus ten years. Retain evidence of the alternatives considered and the decision-making process.
Common Gaps in Cross-Border Transfer Documentation
Organizations that have not systematically documented their cross-border flows typically exhibit three gaps:
Incomplete inventories: Transfers embedded in cloud services, software-as-a-service agreements, and third-party integrations often go undocumented because procurement teams do not recognize them as data transfers. A complete inventory requires collaboration between legal, IT, procurement, and business units.
Generic clauses: Standard contractual clauses copied from a template without tailoring to the specific transfer—omitting the categories of data, the purpose, or the security measures—do not satisfy SDAIA's expectation of documented safeguards. Each clause set must reflect the actual arrangement.
Absent retention policies: Organizations that implement safeguards but do not retain the documentation—or that retain it in dispersed locations without a central register—cannot demonstrate compliance during an inspection. A central repository, indexed by transfer and by safeguard type, is essential.
A Sensible Order of Work
A systematic approach to Article 23 compliance proceeds in four steps:
Step one: Inventory all cross-border flows. Map every system, service, and contract that involves the transfer of personal data outside the Kingdom. Include employee data, customer data, and data processed on behalf of others. Record the destination country, the recipient, the categories of data, and the purpose of the transfer.
Step two: Assign a safeguard to each flow. For each transfer, determine which of the five safeguards applies. Prioritize adequacy decisions where available, then standard contractual clauses for routine processor relationships, binding corporate rules for intra-group transfers, and necessity justifications for specific, non-routine transfers. Reserve consent for exceptional cases.
Step three: Document the safeguard. Draft, negotiate, and execute the required agreements or justifications. Tailor standard clauses to the specific transfer. Obtain board approval for binding corporate rules. Record consent in a structured format. Prepare necessity justifications with supporting evidence.
Step four: Establish a retention and review process. File all safeguard documentation in a central repository. Schedule periodic reviews to confirm that adequacy decisions remain in force, that contractual clauses reflect current arrangements, and that necessity justifications remain valid. Retain all documentation for the required periods.
How the Personal Data Protection Program Addresses Cross-Border Transfers
The Personal Data Protection (PDPL) Program builds a compliance program that includes data inventory and records of processing, lawful bases, notices, data-subject rights, breach notification, transfers and DPO support. The program is delivered over 8–12 weeks and proceeds through four phases: Discover, with interviews and data mapping across departments and systems; Assess, identifying gaps against PDPL and its implementing regulations; Build, producing notices, processes, templates and controls; and Operate, providing training, DPO support and first compliance review.
Among the deliverables are records of processing activities, privacy policy and notices, data-subject request workflow, breach response and notification plan, and privacy impact assessment template. The program includes cross-border transfer assessment as a feature, mapping each transfer to the appropriate safeguard and producing the documentation SDAIA expects.
Organizations that need to establish or validate their cross-border transfer safeguards, or that require support in preparing for a SDAIA inspection, can begin with the Personal Data Protection (PDPL) Program.
