Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)

Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)

Type	Instrument
Code	43045328
Issuing authority	Saudi Central Bank (SAMA)
Framework	Financial services
Tier	Rules, controls & standards
Legal status	In force
Instrument number	43045328 · Saudi Central Bank (SAMA)
Issued	2021-12-23 (19/5/1443H)
Dates	No. 43045328, 19/5/1443H (23 December 2021); rulebook revision reflects the PDPL as amended by M/148
Last verified	2026-10-20

The Saudi Central Bank (SAMA) circular "Adherence to the PDPL and Data Governance Policies, Regulations and Rules" (No. 43045328, 19/5/1443H, 23 December 2021) brings the PDPL and SDAIA's data governance rules into SAMA's supervision of all institutions it supervises. ("4725" is the rulebook node, not the instrument number.)

• The current rulebook revision reflects the PDPL as amended by Royal Decree M/148 and cross-refers to circular 44043873 (24/5/1444H).
• Institutions must not require personal data a service does not need.
• They must keep customer data secure and accurate, and use it only for its original purpose.
• They must report the measures taken to SAMA.
• The original 2021 text also directed a review of internal policies and a gap analysis with a board-approved remediation plan.
• The hosted file is the original Arabic circular (no text layer).

Sector rules and the PDPL. Credit data and health data are sensitive data under the PDPL, so the registration trigger in draft Art 34 of the October 2026 amendments to the PDPL Implementing Regulation (IR) would capture most SAMA licensees. A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing. PDPL Arts 30(1) and 42 preserve SAMA's powers. Read with the PDPL, the IR, the Transfer Regulation and the October 2026 draft (comments close 5 November 2026).

Documents

• Hosted official text (PDF, Arabic)
• Official source (rulebook.sama.gov.sa)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• SAMA Cyber Security Framework (CSF)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21