Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Draft standards guides for PDPL certification and audit providers

Draft standards guides for PDPL certification and audit providers

Type	Guideline
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Guidelines & circulars
Legal status	Draft, consultation closed
Instrument number	SDAIA
Dates	Draft. Posted on Istitlaa about 7 July 2026; closing date unconfirmed; no final versions as of 20 October 2026.
Last verified	2026-10-20

Three SDAIA draft standards guides implementing the 2026 licensing and audit rules and Accreditation Certificate Rules:

• standards for issuing accreditation certificates to controllers and processors;
• standards for licensing personal-data audit and inspection activities;
• standards for licensing certificate-issuance activities.

The drafts were posted on Istitlaa about 7 July 2026 and re-publicised by SPA on 21 July, 23 July and 6 August 2026. SDAIA re-invited comments on 6 August; the closing date is unconfirmed. No final versions found as of 20 October 2026. They matter to controllers seeking certificates as transfer safeguards.

Updates for this instrument

• 2026-07-07 · SDAIA consults on standards guides for the PDPL certification and audit market: Three draft standards guides implementing the 2026 licensing rules (standards for issuing accreditation certificates to controllers and processors, for licensing personal-data audit and inspection activities, and for lic

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Rules for Appointing a Personal Data Protection Officer
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
• Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Records of Processing (RoPA) Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21