SDAIA's PDPL Compliance Verification Form: What Your Business Must Prove Now

SDAIA's PDPL Compliance Verification Form: What Your Business Must Prove Now

In early July 2026, Saudi Arabia's Data and AI Authority (SDAIA) began circulating a PDPL Compliance Verification Form to organizations registered as data controllers. This is not a formality. It is an official request that your business prove — with documents and evidence — that it collects, processes, and stores personal data in line with the Personal Data Protection Law (PDPL). The practical takeaway: every organization that handles customer or employee data should assemble its evidence now, because any gap surfaced during this review can expose it to penalties of up to SAR 5 million.

What is the Compliance Verification Form?

It is an official document — dated 7 July 2026 — that SDAIA sends to its registered data controllers, asking them to describe and evidence how they comply with the PDPL. In plain terms: saying you are compliant is no longer enough; you must produce the policies, records, and controls that prove it. The form spans your entire data-governance lifecycle, from the moment data is collected to the moment it is destroyed.

What exactly does the form ask for?

The form requests evidence across nine core areas. It is worth reviewing each one line by line:

• Collection, processing, and storage: how you gather personal data, where you store it, and how you process it.
• Governance frameworks and policies: written, approved policies for data privacy and protection.
• Legal basis for processing: the lawful ground for each processing activity (consent, contract, legal obligation, and so on).
• Third-party management: how you oversee the processors and vendors you share data with.
• Data retention and destruction: defined retention periods and a secure deletion process once data is no longer needed.
• Data subject rights: a mechanism that lets individuals access, correct, and delete their data.
• Cross-border data transfers: controls and safeguards for moving data outside the Kingdom.
• Incident response: a plan to handle and report data breaches.
• Data Protection Officer (DPO): who oversees compliance inside your organization.

Why now? SDAIA is stepping up enforcement

The form did not appear in a vacuum. The PDPL became enforceable back in September 2023, and over the past year SDAIA's specialized committees issued 48 decisions against organizations found in violation — the first substantive wave of rulings. Clear patterns recurred: collecting and processing data without a lawful basis, weak technical and organizational safeguards, and sending marketing messages without prior consent (a violation widespread across retail, telecom, and financial services). Circulating the verification form is the logical next step: moving from reacting to complaints toward requiring organizations to prove compliance proactively.

The penalties: what does non-compliance cost?

The risk is both financial and legal. Fines reach SAR 5 million per violation and can double for repeat offenses. In the most serious cases — such as disclosing sensitive data with intent to harm or for personal gain — the matter escalates to criminal liability, including imprisonment. Add the indirect damage: lost customer trust, stalled deals, and reputational harm. The message is clear: compliance is no longer optional or something to defer.

How to get your business ready: a practical checklist

Do not wait for the form to arrive before you start. Begin now with these steps:

• Build a data map: what personal data you collect, from where, where it lives, and who can access it.
• Document the legal basis for every processing activity, and record customer consent in a provable way.
• Write privacy, retention, and deletion policies — and make sure they are approved and actually enforced, not just on paper.
• Review vendor and service-provider contracts to ensure data-protection and transfer clauses are in place.
• Set up a clear process to receive and answer data subject requests (access, correction, deletion) within the legal timeframes.
• Appoint a data protection officer, even part-time, as a clear point of accountability.
• Build an incident-response plan so everyone knows who does what when a breach occurs.

The technical side: where businesses actually fail

Most gaps are not about intent — they are about systems. Many organizations have a written privacy policy, but their systems do not enforce it: customer data is copied across countless spreadsheets and files, there is no automated way to delete it once the retention period ends, and no log showing who accessed what and when. This is where compliance turns from a document into engineering. In practice that means: access controls, encryption of sensitive data, audit logs that evidence every operation, automated retention and deletion, an interface that lets data subjects exercise their rights, and technical controls over any transfer outside the Kingdom. The form asks about these capabilities, and an honest answer needs a system, not a promise.

How Origami helps

As a technology company, we treat compliance as a solvable engineering problem. We help organizations turn PDPL requirements into real controls inside their systems: accurate data maps, consent management, automated retention and deletion policies, audit logs, dashboards to manage data subject requests, and cross-border transfer controls. The goal is that your answer to the verification form is not just words, but a system that proves your compliance automatically whenever SDAIA asks.

Conclusion

Circulating the Compliance Verification Form signals that the grace period is over and that SDAIA is moving to require proactive proof of compliance. Businesses that prepare their data and systems now will treat the form as routine; those that defer may discover their gaps at the worst possible moment — during the review itself. Start with your data map today.

Sources

• Saudi Data & AI Authority (SDAIA) — Regulations and Policies: sdaia.gov.sa
• Clyde & Co — SDAIA's PDPL Compliance Verification Form (July 2026): clydeco.com
• IAPP — Saudi Arabia's data protection authority steps up enforcement: iapp.org