Wadira — Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Rules for Appointing a DPO

Rules for Appointing a DPO

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Rules, controls & standards
Legal status	Binding

Rules on when and how to appoint a Data Protection Officer. May be folded into the amended Implementing Regulation.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

In this framework

• Personal Data Protection Law (PDPL)
• Implementing (Executive) Regulation
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers
• Standard Contractual Clauses (SCCs)
• Binding Common Rules (BCRs)
• Rules for Auditing & Inspecting Controllers and Processors
• Rules Governing Issuance of Accreditation Certificates
• Committee Working Rules
• Privacy Policy (Notice) Guideline
• Destruction / Anonymisation / Pseudonymisation Guideline
• Personal Data Disclosure Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Transfer to Non-Adequate Country Guideline
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0 — cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-07-27