On 29 June 2026 the committees that review violations of Saudi Arabia's Personal Data Protection Law announced fines and warnings against a number of organisations. One of the violations they named outright: failing to appoint a personal data protection officer although the cases requiring one applied.
Most private companies we talk to assume this role is for government bodies and banks. The text does not say that. Of the three cases that make appointment mandatory, two apply to any private company whose business runs on data, and the examples SDAIA itself gives include cookies, location tracking and CCTV.
This article reads two texts only: Article 32 of the PDPL Implementing Regulation, and the "Rules for Appointing a Personal Data Protection Officer" SDAIA published on 27 August 2024. Then it applies them to five businesses.
The three cases, as the text states them
Paragraph 1 of Article 32 of the Implementing Regulation, repeated in Article 5 of the Rules, says the controller appoints or designates one or more persons responsible for personal data protection in any of these cases:
| Case | Who it covers | The deciding condition |
|---|---|---|
| A | Public entities only | Providing services that involve processing personal data on a large scale |
| B | Any controller | Its core activities consist of processing that by its nature requires regular and systematic monitoring of data subjects |
| C | Any controller | Its core activities consist of processing sensitive personal data |
Notice that the "large scale" test, with its five criteria (number of data subjects, volume of data, type of data, geographic reach, and variety of data subject categories), attaches to case A alone, meaning public entities. A private company is not caught because of the size of its customer base. It is caught because of the nature of its activity: monitoring, or sensitive data. A company with a million customers may not be obliged, and a small clinic may be.
Test one: is the processing your core activity?
The word that decides cases B and C is "core activities". The Rules define them as the activities a controller carries out to achieve its main objectives, then give a practical test: an activity counts as core if the controller cannot deliver its products or services without processing personal data.
The examples the Rules list:
- Insurers that process health data to provide health insurance.
- Financial companies that process their customers' credit data to provide financing products.
- Marketing companies that process personal data for marketing.
In the other direction, the Rules state plainly that supporting activities are not core, and the example given is HR processing employee data. Payroll, iqama files and GOSI records do not on their own require a DPO, even with hundreds of staff.
Test two: what counts as regular and systematic monitoring?
The Rules define both words:
- Regular: continuous, occurring at set intervals, or recurring periodically.
- Systematic: carried out through technical systems, following a defined method, or as part of an overall plan to collect personal data.
Then they give examples few digital businesses escape:
- Collecting health and fitness data through wearable devices.
- Using behavioural analysis techniques for risk assessment.
- Location tracking, cookies and surveillance cameras.
Any technical system that collects data continuously meets both conditions at once. The only remaining question is whether that monitoring is part of your core activity or a tool supporting it.
The trap many fall into: credit data is not "sensitive"
Article 1 of the Law defines sensitive data in paragraph 11: racial or ethnic origin, religious, intellectual or political belief, security and criminal data, biometric data that identifies a person, genetic data, health data, and data indicating that one or both of a person's parents are unknown.
Credit data is not on that list. It has its own definition in paragraph 15. So a financing company does not fall under case C merely because it processes credit data. It does come close to case B if it assesses risk through behavioural analysis, which is an example written word for word into the Rules. The outcome is often the same, but the route is different, and the route matters when you document the decision for SDAIA.
Five businesses, five answers
| Business | Core activity | Case that applies | Result |
|---|---|---|---|
| A clinic group in Jeddah | Treating patients, impossible without health data | C, sensitive data | Obliged |
| A consumer finance or buy-now-pay-later company | Granting credit, with automated scoring | B, behavioural analysis for risk assessment | Very likely obliged |
| A digital marketing agency running targeted campaigns | Marketing, through tracking and cookies | B, regular and systematic monitoring | Obliged |
| A security company selling CCTV monitoring to clients | The monitoring is the service | B | Obliged |
| A factory in Dammam with 300 staff, selling to businesses | Manufacturing; its personal data is staff records and internal security cameras | None: HR is a supporting activity by the text, and the cameras support the business | Probably not obliged, but must review periodically |
The last row needs the most care. The Rules name cameras as an example of monitoring, and do not say outright that security cameras in a factory are a supporting activity. Our conclusion rests on the "can you deliver your product without it?" test, not on explicit text. For cases like this, SDAIA provides on the National Data Governance Platform a guidance tool to determine whether appointing a DPO is mandatory. Use it, and keep its result with the date.
If you are obliged: what appointment actually means
Appointment is not a name on the organisation chart. The Rules set out the following.
Requirements for the person (Article 4): a suitable qualification and experience in data protection, working knowledge of risk management including handling data breaches, knowledge of the regulatory requirements, and integrity with no conviction for a crime against honour and trust. The DPO may be an employee or an external contractor.
Documentation (Articles 6 and 7):
- The appointment is made in writing. An employee's appointment is documented; an external contractor signs an agreement.
- It is announced inside the organisation immediately, with a way to contact the DPO.
- Data subjects get a clear and easy way to reach the DPO.
- The DPO's contact details go to SDAIA as soon as they are appointed, through the National Data Governance Platform, and are updated when the person changes.
Independence (Article 9): the DPO must not be given tasks that conflict with the role or affect their independence. They report organisationally to the Data Management Office if one exists, otherwise to another department while keeping that independence. The controller must give them the resources they need and support their training and professional certification.
The duties: where you find out whether your systems are ready
Paragraph 3 of Article 32 lists the DPO's duties, including:
- Acting as the direct point of contact with SDAIA and carrying out its decisions.
- Overseeing impact assessments and audit and review reports.
- Enabling data subjects to exercise their rights, and answering their requests and complaints.
- Notifying SDAIA of personal data breaches.
- Keeping the records of processing activities up to date.
- Handling violations inside the organisation and taking corrective action.
Two of these no one can do, however capable, without systems behind them.
Notification within 72 hours. Article 24 of the Regulation requires notifying SDAIA within no more than 72 hours from the time the controller becomes aware of the breach, with a description, the time it happened, the time it became known, and the categories and numbers of data subjects affected. A DPO with no record of when the breach became known cannot prove the deadline was met. Work out your actual deadline with the breach notification deadline calculator.
Records of processing activities. Article 33 requires a written, accurate and current record, including the DPO's own details, the purposes of processing, the categories of data and the retention periods. It is kept for as long as the processing lasts plus five years after it ends, and made available to SDAIA on request. In most companies this record is a spreadsheet written by someone who left a year ago.
For technical teams building these systems, our breach notification readiness tutorial builds the data inventory and the incident log in code.
If you are not obliged today
The Rules do not leave you there. Article 9 requires every controller to review the appointment cases periodically, including whether appointment has become, or may become, mandatory. A new product built on location tracking, or a health service you add, changes the answer.
The same article lets a controller check whether the processor it contracts with has a DPO, or ask it to appoint one. If you run payroll, a contact centre or a cloud platform for clients who are obliged, expect that question in your next contract.
What ignoring it costs
Article 36 of the Law punishes any private natural or legal person who violates the Law or its regulations with a warning or a fine of up to SAR 5 million, and the fine may be doubled for repeat violations, up to twice that ceiling. The June 2026 decisions show the committees are looking at this violation specifically. The full penalty picture is in our article on Saudi PDPL penalties and the 72-hour breach deadline, and if you send customer data to AI models outside the Kingdom, also read PDPL cross-border transfers through AI APIs.
What to do this month
- Write your core activity in one line, then ask: can I deliver it without personal data?
- List your monitoring systems: cookies and analytics tools, in-app location tracking, cameras, any automated customer scoring. For each one: is it the service, or a tool supporting it?
- List your sensitive data against paragraph 11 word for word, not by impression.
- Run SDAIA's guidance tool and keep the result with its date.
- If you are obliged: appoint in writing, announce internally, and register on the National Data Governance Platform the same day.
- Build what the DPO needs to work: the records of processing activities, and an incident log that proves when a breach became known.
The bottom line
A data protection officer is not a requirement for large organisations. It is a requirement for organisations whose business consists of monitoring people or processing their sensitive data, whatever their size. And the question SDAIA asks will not stop at "do you have a DPO?". It will be "can they prove when they learned of the breach, and what you process and why?".
If your personal data is spread across HR, the store, the app and the marketing tools with no single record tying it together, that is exactly what we build: a layer that reads those systems and produces the records of processing and the incident log a DPO needs. Start with a short diagnostic session where we work out which of the three cases applies to you and where your data sits: get in touch.
Sources: Rules for Appointing a Personal Data Protection Officer, SDAIA, published 27 August 2024 (dgp.sdaia.gov.sa, Knowledge Centre). PDPL Implementing Regulation, Articles 24, 32 and 33. Personal Data Protection Law, Royal Decree M/19 as amended by Royal Decree M/148, Articles 1 and 36. Report on the violation committees' decisions, Ajel, 29 June 2026.