Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations

Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Rules, controls & standards
Legal status	In force
Version	V1
Dates	Version 1. In force.
Last verified	2026-10-20

Version 1. Binding procedural rules for the SDAIA committees formed under PDPL Art 36. They cover complaints, hearings, decisions (a warning or a fine up to SAR 5m, doubled for repeat violations) and appeals to the competent court. See PDPL enforcement.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Rules for Appointing a Personal Data Protection Officer
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
• Draft standards guides for PDPL certification and audit providers
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21