Overview
Personal Data Protection Law (PDPL) Article 21 requires Controllers to provide timely and compliant responses when Data Subjects exercise their rights (DSR) under the Law. These rights must be fulfilled within the periods and through the methods defined in the Regulations.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 21
The Controller shall respond to the requests of the Data Subject pertaining to their rights under this Law within such period and in such method as set out in the Regulations.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Timely and Proper Responses
This provision requires the Controller to respond to Data Subject requests (DSR) within the timelines established in the Regulations. The requirement ensures that any request related to the rights granted under the PDPL receives a response within a defined and predictable period.
Controllers must adhere to the procedures and response methods outlined in the Regulations so that individuals receive clear and accessible outcomes for their requests.
Compliance With Response Procedures
The Article confirms that the manner of responding to Data Subject requests (DSR) must follow the specific processes set out in the Regulations. These processes govern how requests are received, assessed, and delivered.
The obligation ensures consistency in how Controllers interact with Data Subjects and supports accurate, lawful responses that meet PDPL requirements.
