Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Personal Data Protection (PDPL) › Records of Processing (RoPA) Guideline

Records of Processing (RoPA) Guideline

Type	Guideline
Issuing authority	Saudi Data & AI Authority / National Data Management Office (SDAIA / NDMO)
Framework	Personal Data Protection (PDPL)
Tier	Guidelines & circulars
Legal status	In force
Version	1.0
Dates	Version 1.0, August 2024.
Last verified	2026-10-20

Version 1.0, August 2024; eight minimum items and a sample template.

Proposed: the October 2026 draft removes the content list and templates from Implementing Regulation Art 33 and places records on each controller's register entry on SDAIA's platform (Art 34(2)). The duty under PDPL Art 31 is unchanged. The Law's own list omits categories of personal data, DPO details, the transfer basis and security measures.

Documents

• Hosted official text (PDF, English)
• Official source (sdaia.gov.sa)

In this framework

• Personal Data Protection Law (PDPL)
• Implementing Regulation of the Personal Data Protection Law
• Draft Amendments to the Implementing Regulation of the PDPL (October 2026)
• Draft Amendments to the Implementing Regulation of the PDPL (April–May 2025)
• Regulation on Personal Data Transfer Outside KSA
• Rules Governing the National Register of Controllers within the Kingdom
• Draft Requirements for Practising Personal Data Protection Activities (April 2025)
• Rules for Appointing a Personal Data Protection Officer
• Standard Contractual Clauses (SCCs)
• Guidelines for Binding Common Rules (BCR) for Personal Data Transfer
• Rules Governing the Issuance of Accreditation Certificates to Controllers and Processors
• Rules Governing the Licensing to Issue Accreditation Certificates to Controllers and Processors, and the Auditing and Inspection of Personal Data Processing Activities
• Rules of Procedure on Committees for Reviewing Violations of the Provisions of the PDPL and its Implementing Regulations
• Draft standards guides for PDPL certification and audit providers
• Privacy Policy (Notice) Guideline
• Destruction, Anonymisation and Pseudonymisation Guideline
• Personal Data Disclosure Cases Guideline
• Personal Data Breach Incidents Procedural Guide
• Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom
• Self-Assessment Guideline (incl. DPO-need tool)
• Minimum Personal Data Determination Guideline
• Guide to the PDPL for Controllers and Processors

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21