Overview
The Rules Governing the National Register of Controllers Within the Kingdom Article 7 sets out the mandatory information that must be provided on the National Data Governance Platform when a Personal Data Protection Officer (DPO) is appointed.
It specifies distinct data requirements depending on whether the DPO is an internal employee, an external contractor within the Kingdom, or a contractor located outside the Kingdom, ensuring proper identification, verification, and regulatory communication.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 7: Information of the Personal Data Protection Officer
- If a Personal Data Protection Officer is appointed in accordance with Article (6) of these rules, the representative shall fill in the Personal Data Protection Officer's information on the Platform to create the Controller’s account.
- If the Personal Data Protection Officer is an employee of the Controller or an external contractor, the representative must provide the following information:
- National ID/residency number for data retrieval purposes.
- Date of birth for verification of the entered national ID/residency number.
- Official contact information (phone number, email).
- If the Personal Data Protection Officer is a contractor located outside the Kingdom, the representative must provide the following information:
- First and last name.
- Official email.
- Official contact number.
- The representative may appoint themselves as the Personal Data Protection Officer if they are appointed by the Controller.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Article 7(1)
Platform Registration of the Personal Data Protection Officer (DPO)
Article 7(2)
Information Requirements for Internal and Local External DPOs
Where the Personal Data Protection Officer (DPO) is an employee of the Controller or an external contractor, the representative must provide identity and verification data, including the national ID or residency number and date of birth. Official contact details must also be recorded to enable communication and regulatory follow up.
