Personal Data Processing Activities Records Guideline – Introduction says that this guideline helps organizations understand and comply with their obligation to maintain records of personal data processing activities under the Saudi Personal Data Protection Law (PDPL). It supports entities in preparing these records by offering detailed instructions and a sample RoPA template. While informative, the guideline is not legally binding—it complements the Law and its Implementing Regulations, which remain the primary legal authority.
Introduction
In fulfillment of its mandate to raise awareness among entities subject to the provisions of the Personal Data Protection Law the “Law” and its Implementing Regulations, and to enable those entities to understand their obligations under Article (31) of the Law and Article (33) of the Implementing Regulations, the Saudi Data & AI Authority (SDAIA) has issued this Guideline to assist entities in preparing records of personal data processing activities. This Guideline also provides a sample template for the records of personal data processing activities, designed to assist Controllers in complying with the Law’s provisions and Implementing Regulations when preparing their records of personal data processing activities. The terms and phrases used in this Guideline shall be construed in accordance with the definitions provided in the Law and its Implementing Regulations. This Guideline shall not be considered a binding legal document, nor shall it substitute consulting the Law and its Implementing Regulations, which shall constitute the regulatory reference for all matters related to the application of the Law’s provisions.
