KSA PDPL » Saudi PDPL Article 30 – Competent Authority (SDAIA) and DPO Appointment

Saudi PDPL Article 30 – Competent Authority (SDAIA) and DPO Appointment

This article is verified from SDAIA
halaprivacy.com
Athif Mohammed
Published: November 10, 2025
Updated: January 11, 2026

Overview

Saudi Personal Data Protection Law (KSA PDPL) Article 30 explains the powers of the Competent Authority, SDAIA, and outlines how supervisory oversight is carried out across all sectors in the Kingdom.

It also sets the rules for when controllers must appoint a Data Protection Officer (DPO) and clarifies what responsibilities apply to that role. The Article grants SDAIA authority to investigate, request documents, enforce compliance, and supervise data protection practices. It also authorizes SDAIA to issue rules, coordinate with external entities, and operate national monitoring tools.

This Article forms the foundation of Saudi Arabia’s national data protection supervision model. It provides controllers with clear expectations on when a DPO is required, what support they must provide to SDAIA, and the mechanisms SDAIA uses to maintain regulatory oversight under the Personal Data Protection Law (PDPL).

SDAIA's Official PDPL Text

The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.

Article 30

Without prejudice to the provisions of this Law and the powers of the Saudi Central Bank pursuant to applicable legal provisions, the Competent Authority shall be the entity in charge of overseeing the implementation of this Law and the Regulations.

The Regulations shall identify the situations where the Controller shall appoint one or more persons as personal data protection officer(s). and shall set the responsibilities of any such person in accordance with the provisions of this Law.

The Controller shall cooperate with the Competent Authority in performing its duties to supervise the implementation of the provisions of this Law and the Regulations, and shall take such steps as necessary in connection with the related matters referred to the Controller by the Competent Authority.

The Competent Authority, in order to carry out its duties related to supervising the implementation of the provisions of the Law and Regulations, may:

Request the necessary documents or information from the Controller to ensure its compliance with the provisions of the Law and Regulations.

Request the cooperation of any other party for the purposes of support in accomplishing supervisory duties and enforcement of the provisions of the Law and Regulations.

Specify the appropriate tools and mechanisms for monitoring Controllers’ compliance with the provisions of the Law and the Regulations, including maintaining a national register of Controllers for this purpose.

Provide services related to Personal Data protection through the national register referred to in Subparagraph (c) of this Paragraph or through any other means deemed appropriate. The Competent Authority may collect a fee for the Personal Data protection services it may provide.

The Competent Authority may, at its discretion, delegate to other authorities the accomplishment of some of its duties that are related to supervision or enforcement of the provisions of the Law and Regulations.

Plain-Language PDPL Explanation

The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.

PDPL Article 30(1)

Competent Authority (SDAIA) Oversees PDPL Implementation

This provision establishes SDAIA as the primary supervisory body responsible for overseeing the implementation of the PDPL and its Regulations, except where the Saudi Central Bank has jurisdiction under applicable law.

This establishes SDAIA as the central authority for supervising personal data protection while respecting sector-specific supervisory roles.

PDPL Article 30(2)

Regulations Determine When DPOs Are Required

This provision explains that the Implementing Regulations specify the scenarios in which a Controller must appoint one or more Data Protection Officers.

It also clarifies that the responsibilities and duties of the DPO are defined by the Implementing Regulations in accordance with the PDPL.

PDPL Article 30(3)

Controllers Must Assist SDAIA in Supervisory Duties

This provision requires Controllers to cooperate with the Competent Authority. This includes responding to inquiries, submitting requested information, and taking necessary actions related to matters referred by SDAIA to support compliance with the Law and its Regulations.

Powers of the Competent Authority

The following sub-paragraphs detail the specific powers granted to the Competent Authority (SDAIA) to carry out its supervisory duties.

PDPL Article 30(4)(A)

Authority Can Demand Documents to Assess Compliance

This provision empowers SDAIA to request any documents or information needed to verify a Controller’s compliance. This ensures regulators can audit, inspect, or assess compliance without delay and without procedural obstacles.

PDPL Article 30(4)(B)

Authority Can Involve Other Agencies in Supervision

This provision allows SDAIA to seek cooperation from other entities, public or private, to support supervisory or enforcement duties under the PDPL.

PDPL Article 30(4)(C)

Authority to Establish Monitoring Tools and a National Register

This provision grants SDAIA the power to determine mechanisms for monitoring compliance, including maintaining a national register of Controllers.

PDPL Article 30(4)(D)

Competent Authority SDAIA to Provide Data Protection Services and Charge Fees

This provision authorizes SDAIA to provide personal data protection services through the national register or other means it deems appropriate and to collect fees for such services.

PDPL Article 30(5)

SDAIA May Delegate Supervisory or Enforcement Duties

This provision permits SDAIA to delegate parts of its supervisory or enforcement duties to other authorities, enabling effective and sector-specific regulatory oversight across the Kingdom.

Frequently Asked Questions (FAQs)

Under the Saudi Personal Data Protection Law (KSA PDPL), who is the “Competent Authority” mentioned in Article 30?

It refers to the authority responsible for supervising and enforcing PDPL, which is SDAIA. Article 30 outlines its oversight role and its connection to DPO appointment requirements.

Does every business in Saudi Arabia need to appoint a Personal Data Protection Officer (DPO) under Article 30?

Not automatically. Article 30 states that a DPO must be appointed when the Regulation requires it, usually based on the nature and scale of processing.

In e-commerce, does handling large volumes of customer data mean a DPO is mandatory?

Possibly, depending on whether the processing meets risk or scale thresholds defined in the Regulation. Article 30 links DPO appointment to those conditions.

For HR, does managing employee personal data require appointing a DPO?

Not always. A DPO is required only when the Regulation triggers apply, not simply because HR handles Personal Data.

What is the difference between a “DPO appointment” and a general privacy or compliance role?

A DPO has duties defined by PDPL and reports independently on compliance. Regular roles may support privacy work but do not carry Article 30’s specific responsibilities.

Can a company outsource the DPO function under Saudi PDPL?

Article 30 does not forbid outsourcing. In practice, a business may use an external DPO as long as the appointment meets PDPL requirements.

In fintech, does high-risk financial processing typically trigger the need for a DPO?

It may, depending on the risk criteria in the Regulation. Article 30 requires a DPO when the type of processing meets those thresholds.

Can one DPO serve multiple companies under Saudi PDPL?

Article 30 does not prohibit shared arrangements. The key requirement is that the DPO can perform duties effectively for each Controller.

Does the DPO make compliance decisions, or does the Controller remain responsible?

The Controller remains responsible. A DPO advises and monitors but does not replace the Controller’s accountability under PDPL.

Is appointing a DPO enough to meet PDPL compliance?

No, the DPO is only one component of compliance. Article 30 assigns oversight responsibilities, but the broader PDPL duties remain with the Controller.

Common misconception, “Only large organizations need a DPO under Saudi PDPL.” Is that true?

Not necessarily. The requirement depends on processing risks and types, not the size of the organization.

In SaaS platforms, does the vendor provide the DPO or the Saudi customer?

Typically the Saudi customer, as the Controller, meets the DPO obligation when triggered. The SaaS vendor may act as a Processor and does not assume this requirement.

Saudi Personal Data Protection Law Compliance Services (KSA PDPL)

KSA PDPL Compliance Implementation

Achieve PDPL Compliance in 4 weeks or less.

Data Protection Officer As A Service (DPOaaS)

Let us handle your daily PDPL Compliance Operations.

KSA PDPL Compliance Audit (External)

Audit your PDPL compliance obligations.

Table of Contents

← PDPL Compliance Ecosystem