Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Rules for Appointing a Personal Data Protection Officer

Rules for Appointing a Personal Data Protection Officer

Type	Rule
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Rules, controls & standards
Legal status	In force, proposed for repeal
Version	1.0
Dates	Version 1.0, August 2024. In force; proposed for repeal (October 2026 draft).
Last verified	2026-10-20

Rules for Appointing a Personal Data Protection Officer, v1.0, August 2024. In force.

• Triggers (Art 5): a public entity providing large-scale processing services; core activities requiring regular and systematic monitoring; core activities involving sensitive data. The Rules define "large scale", "regular and systematic monitoring" and "core activities".
• Other provisions: qualifications (Art 4); written appointment and DPO contact details lodged on the National Data Governance Platform (Arts 6–7); additional duties (Art 8); resources, no conflicting tasks and processor checks (Art 9).
• Proposed: the October 2026 draft would repeal these Rules and move the triggers into Implementing Regulation Art 32, dropping "large scale" for public entities and adding it to the monitoring trigger. The definitions, qualifications and independence provisions are not carried over.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
• Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations
• Draft standards guides for PDPL certification and audit providers
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21