KSA PDPL » Rules for Appointing Personal Data Protection Officer (DPO) Article 7 – DPO Contact Details

Rules for Appointing Personal Data Protection Officer (DPO) Article 7 – DPO Contact Details

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 16, 2025
Updated: December 23, 2025

Overview

Rules for Appointing Personal Data Protection Officer Article 7 sets out the communication and notification obligations associated with the DPO role.

It requires Controllers to ensure that Data Subjects can easily contact the DPO and mandates immediate notification to the Competent Authority of the DPO’s contact details through the National Data Governance Platform, including timely updates whenever the appointed DPO changes.

SDAIA's Official Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 7: DPO Contact Details

The Controller must provide a clear and accessible means of communication with the DPO for data subjects.

The Controller must provide the competent authority with the DPO's contact details immediately upon their appointment, through the National Data Governance Platform, and update these details when the DPO changes.

Plain-Language Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

Article 7(1)

Accessible Communication for Data Subjects

This provision requires Controllers to establish clear and easily accessible communication channels between Data Subjects and the DPO. The intent is to ensure that individuals can directly reach the DPO regarding personal data protection matters, including inquiries, complaints, and the exercise of their rights.

Article 7(2)

Notification to the Competent Authority

This provision obligates Controllers to notify the Competent Authority of the DPO’s contact details immediately after the appointment is made. The notification must be submitted through the National Data Governance Platform, ensuring regulatory visibility and oversight of the appointed DPO.

Ongoing Update Obligation

This provision further requires Controllers to keep the DPO contact information up to date. Whenever the appointed DPO changes, the Controller must promptly update the relevant details on the National Data Governance Platform to maintain accuracy and continuity of regulatory communication.

Saudi Personal Data Protection Law Compliance Services (KSA PDPL)

KSA PDPL Compliance Implementation

Achieve PDPL Compliance in 4 weeks or less.

Data Protection Officer As A Service (DPOaaS)

Let us handle your daily PDPL Compliance Operations.

KSA PDPL Compliance Audit (External)

Audit your PDPL compliance obligations.

Table of Contents

← PDPL Compliance Ecosystem