Overview
Saudi Personal Data Protection Law (KSA PDPL) Article 33 authorises SDAIA, acting as the Competent Authority, to regulate the licensing, accreditation, and oversight of entities providing data protection–related services in Saudi Arabia. These responsibilities include defining entry requirements, granting licences or accreditation, approving audit firms, and establishing monitoring tools to ensure compliance with the Personal Data Protection Law.
Article 33 strengthens professional accountability, enhances regulatory oversight, and supports governance standards for entities operating inside and outside the Kingdom when processing Saudis’ personal data.
Saudi PDPL Article 33
- The Competent Authority shall set the requirements for practicing commercial, professional or non-profit activities related to Personal Data protection in the Kingdom, in coordination with the competent authorities, and without prejudice to the other requirements set by those authorities in their domain of competence.
- The Competent Authority may grant licenses to entities that issue accreditation certificates to Controllers and Processors. The Competent Authority shall set the rules to regulate the issuance of such certificates.
- The Competent Authority may grant licenses to entities that conduct audits or checks of Personal Data Processing activities related to the Controller’s activity, in accordance with the provisions stipulated in the Regulations. The Competent Authority shall set the conditions and criteria to grant such licenses, and the rules regulating them.
- The Competent Authority shall specify the appropriate tools and mechanisms to monitor compliance of Controllers and Processors outside the Kingdom in regard with their obligations as stated in the Law and the Regulations when Processing personal data related to individuals residing in the Kingdom by any means, and shall define procedures to enforce the provisions of the Law and the Regulations outside the Kingdom.
Explanation of Saudi PDPL Article 33
Article 33(1)
Requirements for Practicing Personal Data Protection Activities
This provision empowers SDAIA to establish the eligibility criteria for any commercial, professional, or non-profit entity that provides services involving personal data protection in Saudi Arabia.
These criteria define who may offer advisory, operational, technical, or governance-related services, and ensure that only qualified organisations enter the regulated PDPL services market.
SDAIA must coordinate with other sectoral regulators to avoid conflicting requirements and to maintain consistency across industries.
Article 33(2)
Licensing Accreditation Bodies
This provision authorises SDAIA to licence entities that provide accreditation certificates to Controllers and Processors.
These accredited bodies may evaluate whether organisations meet PDPL compliance standards.
SDAIA will set the rules governing how these certificates are issued, renewed, revoked, or validated, ensuring that accredited entities operate with integrity and follow recognised standards.
Article 33(3)
Licensing Audit and Compliance Review Firms
This provision allows SDAIA to license firms that perform PDPL compliance audits or conduct checks on personal data processing activities.
These firms may inspect security measures, governance controls, data handling practices, and other PDPL obligations.
SDAIA will define the criteria for selecting eligible firms, such as competency, independence, operational capability, and professional accreditation, ensuring that audits are conducted reliably and lawfully.
Article 33(4)
Oversight of Foreign Controllers and Processors
This provision requires SDAIA to implement enforcement mechanisms for Controllers and Processors located outside Saudi Arabia when they process the personal data of individuals residing in the Kingdom.
SDAIA must define monitoring tools, compliance procedures, and enforcement pathways to ensure these foreign entities follow PDPL requirements, including when processing occurs cross-border or via remote digital services.
This rule strengthens data sovereignty and extends PDPL protections globally for Saudi residents.
