Most boards in the Kingdom have approved a personal data protection program. Far fewer have seen the evidence behind it. When the regulator, SDAIA, examines compliance with the Personal Data Protection Law (PDPL), it tends to start with a small set of artifacts. Understanding PDPL data inventory requirements, and what sits behind them, is the fastest way for directors to judge whether the program is real.
This article gives three questions. Each can be put to management at the next committee meeting, and each produces an answer that is either evidenced or it is not.
Why the data inventory comes first
A data inventory, together with records of processing activities, is the foundation of the program. It lists what personal data the institution holds, where it sits, who uses it, why, and who receives it. Without it, no one can say with confidence whether notices are accurate, whether rights requests are complete, or whether a breach has touched personal data.
For a board, the inventory is not a technical document. It is the single source from which the three questions below can be answered. If management cannot produce it, that is the first finding.
Question 1: Which processing activities lack a lawful basis?
PDPL requires that personal data be processed on a recognised legal basis, and consent is only one of those. Others exist, such as the performance of a contract or a legitimate interest, subject to the conditions in the law and its implementing regulations. Each processing activity should be mapped to one basis, and that mapping should be recorded.
Ask management:
- Does every processing activity in the inventory show a lawful basis?
- Who decided each basis, and when was it last reviewed?
- How many activities have no basis recorded, and what is the plan for them?
How to read the answer
A good answer is a list with a basis against every line and a short, named list of exceptions with owners and dates. A weak answer is "we rely on consent for everything" or "legal is looking at it." Relying on consent where another basis fits can create its own problems, because consent can be withdrawn and processing may then have to stop.
Watch for activities that grew informally: marketing lists, analytics, vendor-held data, and legacy systems. These are where missing bases usually hide.
Question 2: Which cross-border transfers have no safeguards?
PDPL places conditions on transferring personal data outside the Kingdom, and the implementing regulations set out the circumstances and safeguards that apply. Many institutions transfer data without realising it, through cloud services, support providers, group reporting and software that processes data abroad.
Ask management:
- Do we have a complete list of transfers outside the Kingdom, by system and by recipient?
- For each, which condition or safeguard is relied on, and where is the assessment?
- Who approves a new transfer before it begins?
How to read the answer
A good answer is a register of transfers, each with a documented assessment and an owner, plus a procurement step that triggers review before a new provider is signed. A weak answer lists only the obvious cloud platform, or says the vendor contract "covers it" without any assessment on file.
Boards should also ask whether the transfer register agrees with the data inventory. If a system holds personal data and is hosted or supported abroad, it should appear in both.
Question 3: Where is consent documentation stored?
Where consent is the lawful basis, the institution must be able to show that it was obtained properly and that it can be withdrawn as easily as it was given. An auditor will want evidence, not a policy statement.
Ask management:
- Where is each consent record held, and is it linked to the individual and the purpose?
- Can we show what the person was told at the time?
- Is there a log of withdrawals, and how quickly is each one acted on across every system?
How to read the answer
A good answer points to a defined system of record, shows a sample record end to end, and shows a withdrawal log with dates of request and completion. A weak answer is that consent sits "with each business line," in forms, spreadsheets or email. Scattered records make it hard to honour a withdrawal everywhere it matters.
What to fund and what to measure
If the three answers reveal gaps, the board's role is to make sure the remedy is resourced and tracked, not to design it. Three measures are practical:
- The share of processing activities with a recorded lawful basis, reported each quarter without needing a statistic from outside sources, simply as complete against total.
- The number of cross-border transfers with a completed assessment against the number on the register.
- The time taken to act on consent withdrawals and data-subject requests, against the institution's own target.
Funding usually goes to three things: time from business owners to complete the inventory, a named owner for the transfer register, and a single place for consent records. Ask also whether a data protection officer is needed. That depends on the nature and scale of processing under the implementing regulations, so it should be a documented decision rather than an assumption.
A short checklist for the next committee meeting
- Ask for the data inventory and records of processing, and check their date of last update.
- Ask for the list of activities without a lawful basis.
- Ask for the cross-border transfer register and the assessments behind it.
- Ask to see one consent record and one withdrawal from start to finish.
- Agree dates and owners for every gap, and put them on the committee tracker.
How we help
Our Personal Data Protection (PDPL) Program builds the compliance program around exactly these artifacts. It covers data inventory and records of processing, lawful bases, notices, data-subject rights, breach notification, transfers and DPO support.
The work runs in four stages: Discover, with interviews and data mapping across departments and systems; Assess, with gaps against PDPL and its implementing regulations; Build, with notices, processes, templates and controls; and Operate, with training, DPO support and a first compliance review. The project runs 8–12 weeks. Deliverables include records of processing activities, a privacy policy and notices, a data-subject request workflow, a breach response and notification plan, and a privacy impact assessment template. If your board wants to put the three questions to management and needs a clear view of the answers, we can start there.
