Overview
PDPL Implementing Regulation Article 23 defines the security obligations that Controllers must implement to protect Personal Data and maintain the privacy of Data Subjects. It requires Controllers to adopt necessary organizational, administrative, and technical safeguards to limit risks related to Personal Data Breaches and to comply with cybersecurity controls and standards issued by the National Cybersecurity Authority (NCA).
Where such controls are not mandatory, Controllers must rely on recognized best practices and established cybersecurity standards. The Article reinforces that security and privacy protection must be embedded across all Processing activities in alignment with PDPL requirements.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 23: Information Security
The Controller shall take the necessary organizational, administrative, and technical measures to ensure the security of Personal Data and the privacy of the Data Subjects, and shall comply with the following:
- Implement necessary security and technical measures to limit security risks related to Personal Data Breach.
- Comply with relevant controls, standards, and rules issued by the National Cybersecurity Authority or recognized best practices and cybersecurity standards if the Controller is not obligated to follow the controls, standards, and rules issued by the National Cybersecurity Authority.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Article 23 (1)
Security Risk Mitigation
Article 23 (2)
Cybersecurity Standards Compliance
This provision requires the Controller to follow the controls, standards, and rules issued by the National Cybersecurity Authority (NCA). When such requirements are not mandatory, the Controller must follow recognized best practices and cybersecurity standards.
