SDAIA PDPL Enforcement Update Q1 2025: The Four New Inspection Priorities Every Data Controller Must Address by June
SDAIA PDPL enforcement 2025 activity has entered a new phase. The Saudi Data and Artificial Intelligence Authority has intensified its inspection programme in the first quarter of this year, and a clear pattern has emerged across recent compliance visits. Four specific areas now receive disproportionate attention during every inspection: consent documentation, data-subject rights response times, processor contracts and cross-border transfer mechanisms.
Data controllers who have treated the Personal Data Protection Law as a documentation exercise are discovering that SDAIA expects operational evidence. Inspectors are asking to see timestamped records, testing workflows in real time and requesting proof that policies translate into daily practice. The gap between what organisations have written and what they can demonstrate is now the primary source of enforcement findings.
This update summarises the four inspection priorities observed in recent SDAIA visits and explains what data controllers must prepare before the next inspection cycle.
The Shift in SDAIA's Inspection Approach
SDAIA's early enforcement activity focused on the existence of foundational documents: privacy policies, records of processing and data protection officer appointments. Inspections in late 2024 began to probe deeper, but the approach remained largely document-centric.
The inspections conducted in Q1 2025 represent a different methodology. SDAIA inspectors now arrive with specific scenarios and ask organisations to demonstrate their response. They select a sample of data subjects and request evidence of how consent was obtained. They ask to observe the data-subject rights request workflow from receipt to closure. They review processor contracts and then verify that the contractual terms are reflected in actual processing arrangements.
This operational focus has exposed weaknesses in many PDPL compliance programmes. Organisations that invested heavily in policy drafting but lightly in implementation are now facing corrective action notices with tight remediation deadlines.
Priority One: Consent Documentation and Audit Trails
The first area under scrutiny is consent. SDAIA is examining not only whether organisations have obtained consent where required, but whether they can prove it for individual data subjects.
Inspectors are selecting specific customer or employee records and asking to see the consent record. They want to know when consent was obtained, through which channel, what information was provided at the point of collection and whether the data subject had a genuine choice. They are also checking whether consent is granular—whether data subjects were offered separate choices for different processing purposes.
Organisations that rely on implied consent, pre-ticked boxes or bundled consent are receiving findings. SDAIA expects explicit, informed and freely given consent for processing activities that require it under the PDPL, and it expects organisations to be able to produce the evidence on demand.
The most common deficiency is the absence of an audit trail. Many organisations can show that their current web forms or application processes include consent mechanisms, but they cannot demonstrate that consent was obtained from data subjects whose personal data was collected months or years ago. SDAIA is not accepting retroactive compliance in this area.
Priority Two: Data-Subject Rights Response Times and Completeness
The second priority is data-subject rights. SDAIA is testing whether organisations can respond to access, correction, deletion and objection requests within the timeframes required by the PDPL and its implementing regulations.
Inspectors are submitting test requests during visits and observing how the organisation handles them. They are also reviewing past requests to verify response times and the completeness of responses. Organisations that have established a data-subject rights process on paper but have not tested it in practice are discovering gaps when SDAIA applies real-world scenarios.
The most frequent findings relate to response completeness. Organisations often provide partial information in response to access requests, either because they do not have a complete data inventory or because different departments manage personal data in silos. SDAIA expects data controllers to provide a comprehensive response that covers all personal data held about the data subject, regardless of which system or business unit holds it.
Response time is also under scrutiny. The PDPL requires data controllers to respond to data-subject requests without undue delay. SDAIA is interpreting this requirement strictly and is issuing findings where organisations take more than 30 days to respond without a justified reason.
Priority Three: Processor Contracts and Oversight Mechanisms
The third area of focus is data processor relationships. SDAIA is examining whether organisations have appropriate contracts in place with processors and whether those contracts contain the substantive provisions required by the PDPL.
Inspectors are requesting a list of all processors and then sampling contracts for review. They are checking for specific clauses: the subject matter and duration of processing, the nature and purpose of processing, the type of personal data, the categories of data subjects, the obligations and rights of the data controller, and the processor's commitments regarding security, sub-processing and data subject rights.
Many organisations have general service agreements with their vendors but lack specific data processing terms. SDAIA is not accepting this. Where a vendor processes personal data on behalf of the data controller, a compliant processor contract is mandatory.
SDAIA is also examining whether data controllers exercise oversight of their processors. It is not sufficient to have a contract; data controllers must be able to demonstrate that they monitor processor compliance. This includes reviewing security measures, conducting audits where appropriate and maintaining records of any data breaches or security incidents involving the processor.
Priority Four: Cross-Border Transfer Mechanisms and Documentation
The fourth priority is cross-border transfers. SDAIA is scrutinising every transfer of personal data outside the Kingdom and verifying that an appropriate legal mechanism is in place.
Inspectors are asking organisations to identify all cross-border transfers, including those that may not be immediately obvious—cloud storage, group-wide IT systems, customer support platforms and third-party analytics services. They are then requesting evidence of the legal basis for each transfer.
The PDPL permits cross-border transfers only in specific circumstances: where the recipient country has been deemed adequate by SDAIA, where appropriate safeguards are in place, or where one of the specified derogations applies. SDAIA is examining which mechanism organisations are relying on and whether the documentation supports it.
Organisations that transfer personal data to cloud service providers in other jurisdictions are facing particular scrutiny. SDAIA expects data controllers to know where their data is stored and processed, to have assessed the legal framework in the recipient country and to have implemented appropriate safeguards such as standard contractual clauses or binding corporate rules.
The absence of a cross-border transfer inventory is a common finding. Many organisations have not systematically identified all transfers, particularly those embedded in software-as-a-service arrangements or group-wide platforms. SDAIA is requiring data controllers to map these transfers and to document the legal basis for each one.
What Data Controllers Must Do Before the Next Inspection Cycle
The pattern of recent inspections suggests that SDAIA will continue to focus on these four areas throughout 2025. Data controllers should treat the period before June as an opportunity to remediate gaps.
Consent audit: Review all processing activities that rely on consent as the lawful basis. Verify that consent records exist for each data subject, that consent was obtained in a compliant manner and that an audit trail is maintained. Where historical consent records are missing, consider whether an alternative lawful basis applies or whether re-consent is necessary.
Data-subject rights testing: Conduct an internal test of the data-subject rights process. Submit a mock access request and track it through the organisation. Measure response time, verify completeness and identify any departments or systems that are not integrated into the workflow. Update the data inventory to ensure that all personal data holdings are documented and accessible for response purposes.
Processor contract review: Compile a complete list of all processors. Review existing contracts and identify any that lack the required data processing terms. Prepare compliant processor agreements and initiate the amendment or replacement of deficient contracts. Establish an oversight mechanism to monitor processor compliance on an ongoing basis.
Cross-border transfer mapping: Identify all transfers of personal data outside the Kingdom. For each transfer, document the recipient, the purpose, the categories of personal data, the legal mechanism relied upon and any safeguards in place. Where transfers are occurring without an appropriate legal basis, implement the necessary mechanism or cease the transfer.
These are not one-time exercises. SDAIA expects data controllers to maintain these records and processes as part of ongoing compliance. The organisations that perform well in inspections are those that have embedded PDPL requirements into their daily operations, not those that prepare hastily when an inspection is announced.
When to Build or Refresh Your PDPL Compliance Programme
If your organisation cannot immediately produce the documentation and evidence described above, it is time to build or refresh your PDPL compliance programme. The warning signs are clear: missing consent records, untested data-subject rights processes, processor contracts that lack data protection terms and undocumented cross-border transfers.
A good outcome is a compliance programme that operates day to day, not one that exists only on paper. This means having a complete and current data inventory, privacy notices that reflect actual processing, a data-subject rights workflow that delivers timely and comprehensive responses, processor contracts that meet PDPL requirements and a documented approach to cross-border transfers.
CISO Consulting builds PDPL compliance programmes through a structured process. We begin with interviews and data mapping across departments and systems to understand how personal data flows through the organisation. We then assess gaps against the PDPL and its implementing regulations. We build the necessary notices, processes, templates and controls, and we support the organisation in operating the programme through training, data protection officer support and a first compliance review. The engagement typically runs for 8–12 weeks and delivers records of processing activities, privacy policy and notices, a data-subject request workflow, a breach response and notification plan, and a privacy impact assessment template.
If SDAIA's new enforcement priorities have exposed gaps in your programme, now is the time to address them. The next inspection cycle is approaching, and the evidence requirements are clear.
