Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 31 requires controllers to maintain accurate records of their Personal Data Processing activities. These records, often called a Record of Processing Activities (RoPA), are a core accountability tool under the Personal Data Protection Law (PDPL). They make it possible for the Competent Authority (SDAIA) to verify how personal data is collected, used, shared, retained, and transferred, and whether those activities comply with PDPL requirements.
Article 31 also sets the minimum information that must appear in these records, such as contact details, purposes, data subject categories, recipients, cross border disclosures, and retention periods.
Together, these elements support transparency, regulatory oversight, and sound privacy governance for all entities processing personal data in Saudi Arabia.
SDAIA's Official PDPL Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 31
Without prejudice to Article (18) herein, the Controller shall maintain records, for such a period as required under the Regulations, of the Personal Data Processing activities, based on the nature of the activity carried out by the Controller. Such records are to be available whenever requested by the Competent Authority. The records shall contain the following information at a minimum:
- Contact details of the Controller.
- The purpose of the Personal Data Processing.
- Description of the categories of Personal Data Subjects.
- Any other entity to which Personal Data has been, or will be, disclosed.
- Whether the Personal Data has been or will be transferred outside the Kingdom or disclosed to an entity outside the Kingdom.
- The expected period for which Personal Data shall be retained.
Plain-Language PDPL Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
PDPL Article 31
Duty to Maintain Records of Processing Activities (RoPA)
This provision establishes the core duty, every Controller must maintain records of its Personal Data Processing activities. The duration for which these records must be kept is not fixed in the Article itself, instead it is tied to what the Regulations require, taking into account the nature of the processing activities. This gives room for sector specific or risk based retention rules for RoPA, while still making record keeping mandatory.
The paragraph also makes clear that these records are not merely internal tools, they must be made available whenever the Competent Authority requests them, which turns RoPA into a primary mechanism for supervision, audits, and investigations under the PDPL.
PDPL Article 31(1)
Contact details of the Controller
This provision requires the records to include the Controller’s contact details. This identifies the legal entity responsible for compliance with PDPL and provides a clear channel for communication by the Competent Authority and, where relevant, by Data Subjects. In practice, this usually means including the formal legal name, registered address, and official contact points such as email or phone for privacy matters.
Having these details embedded in the RoPA reinforces accountability and avoids ambiguity about who controls the processing in multi entity or group structures.
PDPL Article 31(2)
Purpose of Personal Data Processing
This provision requires documentation of the purpose of each processing activity. This links directly to PDPL’s purpose limitation principle, which expects personal data to be processed for clear, specific, and legitimate purposes. In the RoPA, the purpose description should be concrete enough to show why the data is needed, for example customer onboarding, payroll administration, security monitoring, or fraud prevention, rather than vague labels.
This allows the Competent Authority to assess whether the processing is lawful, proportionate, and consistent with information provided to Data Subjects in privacy notices.
PDPL Article 31(3)
Categories of Personal Data Subjects
This provision obliges controllers to identify and describe the categories of Personal Data Subjects involved in each processing activity. These categories might include employees, job applicants, individual customers, corporate contact persons, vendors, visitors, or online users.
By mapping processing to each category, the controller and the Competent Authority can better understand who is affected, what risks apply to different groups, and which safeguards or rights handling procedures are relevant, for example DSR handling for customers compared to employees.
PDPL Article 31(4)
Entity to which Personal Data has been, or will be, disclosed
This provision requires the RoPA to list any entity to whom personal data has been disclosed or will be disclosed. This covers both internal and external recipients, such as processors, group companies, service providers, payment gateways, analytics providers, or public authorities where disclosure is legally required. Recording these recipients creates a transparent map of the data sharing ecosystem.
It allows SDAIA to verify that appropriate legal bases, contracts, and security measures exist for each disclosure and to check that data flows match the information given in privacy notices and contracts.
PDPL Article 31(5)
Whether Personal Data has been or will be transferred or disclosed outside the Kingdom
This provision focuses specifically on cross border transfers and disclosures to entities located outside the Kingdom. For each processing activity, the records must indicate if any such transfer has taken place or is planned. This item connects Article 31 with the PDPL’s cross border framework, including Article 29 and the dedicated transfer regulations.
By flagging which processing operations involve international transfers, the RoPA enables the Competent Authority to check whether the controller is using approved transfer tools, complying with risk assessments, and applying suitable contractual and technical safeguards for foreign recipients.
PDPL Article 31(6)
Expected Retention Period
This provision requires the controller to record the expected retention period for the personal data processed under each activity. This implements PDPL’s storage limitation principle, which prohibits keeping personal data for longer than necessary. The RoPA should either specify a time frame, such as X years after contract termination, or set out clear criteria linked to legal or operational requirements.
This information helps SDAIA evaluate whether retention periods are proportionate and justified and provides an internal reference that supports deletion routines, anonymization plans, and regular data housekeeping.
