Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities

Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Rules, controls & standards
Legal status	In force
Instrument number	SDAIA (President's decision)
Issued	2025-12-16 (25/06/1447H)
Version	1.0
Dates	Version 1.0 (2026). In force; published in Umm Al-Qura on 6 March 2026.
Last verified	2026-10-20

Licensing rules for certificate issuers and audit providers, not rules on auditing controllers. Version 1.0 (2026). Basis: PDPL Art 33(2)–(3).

• Dates: SDAIA President's decision dated 25/06/1447H (16 December 2025); announced 17 February 2026; published in Umm Al-Qura on 6 March 2026.
• Certificate issuers: SAR 10m capital, at least 10 directly employed assessors, Saudi Accreditation Center accreditation and an in-Kingdom presence.
• Process: SDAIA decides within 90 business days; licences last 3 years; activity data must be stored in the Kingdom.
• Registration: provider registration on the platform opened 9 March 2026.
• Related: the Accreditation Certificate Rules and the draft standards guides (July 2026).
• Proposed: under the October 2026 draft, Implementing Regulation Art 36 would place audit and inspection under these rules, and Art 35 would be deleted.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

Updates for this instrument

• 2026-02-17 · PDPL licensing and audit rules issued: SDAIA President's decisions dated 25/06/1447H (16 December 2025), announced 17 February 2026 and published in Umm Al-Qura on 6 March 2026, create the PDPL compliance-services market: licences for accreditation-certificat

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Rules for Appointing a Personal Data Protection Officer
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations
• Draft standards guides for PDPL certification and audit providers
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21