UAE and Saudi PDPL readiness checklist

Use this checklist to check how ready your organisation is for data protection law in the UAE and Saudi Arabia. It covers the UAE PDPL, the DIFC and ADGM regimes, and the Saudi PDPL. Tick what you can evidence today, and treat every unticked box as an action. This page is general information, not legal advice.

1. Work out which law applies

• ☐ We know which of our entities are on the UAE mainland, in the DIFC, in ADGM or in Saudi Arabia, and which law applies to each (UAE PDPL, DIFC DPL, ADGM DPR or Saudi PDPL).
• ☐ We have checked whether we process the personal data of people in the UAE or Saudi Arabia from outside those countries, which can bring us into scope.
• ☐ We have checked whether GDPR or UK GDPR also applies because we serve people in the EU or UK.
• ☐ We have checked for sector-specific rules on top of the general law, for example in financial services, healthcare or telecoms.

2. Governance and the Data Protection Officer

• ☐ Someone senior owns data protection and reports to leadership.
• ☐ We have assessed whether we must appoint a Data Protection Officer (DPO). Under the UAE PDPL this can apply to high-risk processing, such as large volumes of sensitive data or profiling. Under the Saudi Implementing Regulations it can apply to public entities processing at scale, large-scale regular monitoring of individuals, or core activities that involve sensitive data.
• ☐ If we appoint a DPO, the appointment is documented. In Saudi Arabia, check SDAIA’s current requirements for registering or notifying the appointment of a DPO.
• ☐ Data protection policies exist, are approved and are reviewed at least once a year.

3. Know your data

• ☐ We have a data inventory showing what personal data we hold, where it is stored, who can access it and who we share it with.
• ☐ We have a record of processing activities that matches how we really operate.
• ☐ We know which of our data is sensitive and have extra controls for it.
• ☐ We have a retention schedule and we delete data we no longer need.

4. Lawful basis and consent

• ☐ Each use of personal data has a documented lawful basis.
• ☐ Where we rely on consent, it is freely given, specific, recorded and as easy to withdraw as to give.
• ☐ Our consent flows were designed for the law that applies to us and not copied from a different regime, for example an opt-out model built for US privacy law.

5. Privacy notices and transparency

• ☐ Our privacy notice says what we collect, why, how long we keep it, who we share it with and how people can exercise their rights.
• ☐ Our website cookie notice and consent banner match the cookies and trackers we really use.
• ☐ Employees and job applicants have their own privacy notice.

6. Individual rights

• ☐ We can recognise a request to access, correct, delete, restrict or object, whichever channel it arrives through. The rights available differ by law: the Saudi PDPL gives a narrower set than the GDPR, DIFC DPL, ADGM DPR and UAE PDPL.
• ☐ We verify identity in a proportionate way and keep a log of requests and responses.
• ☐ We know the response deadline under each law that applies to us and can meet it.
• ☐ Where the law that applies to us gives this right (for example the GDPR and UAE PDPL), we have a process for challenging decisions made solely by automated means.

7. Vendors and processors

• ☐ We have a list of every vendor that handles personal data on our behalf.
• ☐ Each one is covered by a written data processing agreement.
• ☐ We review vendor security and sub-processors before signing and at renewal.

8. Cross-border transfers

• ☐ We have mapped every transfer of personal data outside the UAE or Saudi Arabia, including cloud hosting, support teams and group companies.
• ☐ For each transfer we can name the legal mechanism that permits it, such as an adequacy finding or approved safeguards, under every law that applies.
• ☐ Transfers out of Saudi Arabia have been checked against the conditions in the Saudi PDPL and its regulations, because unlawful transfers can carry criminal penalties.
• ☐ High-risk transfers have a documented transfer impact assessment.

9. Security and breach response

• ☐ We have a written incident response plan with named decision-makers.
• ☐ We know our reporting duties. Under the UAE PDPL, a breach that could prejudice privacy or security must be reported to the UAE Data Office immediately. Under the Saudi PDPL, a breach that may cause harm must be reported to SDAIA within 72 hours. GDPR also uses a 72-hour limit.
• ☐ We keep a breach register, including incidents we decided not to report and why.
• ☐ We have rehearsed a breach scenario in the last twelve months.

10. High-risk processing and AI

• ☐ We list every AI tool in use, including tools staff adopted informally.
• ☐ We carry out a data protection impact assessment before launching high-risk processing, including AI and profiling.
• ☐ Where AI influences decisions about people, a human reviewer has real authority, enough information and enough time to overturn the result.

11. Saudi Arabia: extra items

• ☐ We have checked whether our Saudi entity must register as a controller on the National Data Governance Platform. Registration applies to controllers that process sensitive data or whose main activity is processing personal data. Confirm the current list of triggers with SDAIA.
• ☐ We can produce our records within days if SDAIA asks.
• ☐ We understand the penalty exposure. Most violations carry a warning or a fine of up to SAR 5 million (which can be doubled for repeat violations), and intentionally disclosing sensitive data (with intent to harm the individual or to gain a personal benefit) or an unlawful cross-border transfer can also lead to imprisonment.

12. People and records

• ☐ Staff receive data protection training when they join and at least once a year.
• ☐ We can show a regulator or customer our policies, records, assessments and training logs on short notice.
• ☐ We review this checklist at least once a year and whenever our business, systems or the law change.

How to read your results

Most organisations find several gaps in sections 3, 7 and 8, which cover data inventories, vendor agreements and transfers. Start with anything linked to breach reporting, cross-border transfers and sensitive data, because those carry the highest regulatory and reputational risk. Note that the UAE PDPL’s detailed executive regulations and penalty provisions have been slow to arrive, so check the current position before relying on any specific figure for the UAE.

Need help closing the gaps?

A gap analysis turns this checklist into a ranked action plan for your business. We can also provide an outsourced Data Protection Officer, prepare vendor agreements, run transfer impact assessments and support breach response. See our full UAE and regional compliance service, our Saudi PDPL compliance checklist, or book a free consultation.