Overview
The Rules Governing the National Register of Controllers Within the Kingdom Article 4 sets out the mandatory registration procedures on the National Data Governance Platform.
It clarifies the responsibilities of representatives and individuals to complete registration when the conditions in Article 2 are met, and it links the registration process to the obligation to assess whether a Personal Data Protection Officer (DPO) must be appointed under the Implementing Regulation of the Personal Data Protection Law.
SDAIA's Official Text
The text below reproduces official PDPL law, regulation, or guideline issued by the Saudi Data & AI Authority, verified against the original SDAIA source. No changes or reinterpretation applied.
Article 4: Registration Procedures
- The representative must complete the registration process on the Platform when one of the conditions stipulated in Article (2) of these rules is met. The representative should also determine the need to appoint a Personal Data Protection Officer in accordance with the conditions stipulated in Article (32) of the executive regulations of the Personal Data Protection Law and the rules for appointing a Personal Data Protection Officer.
- Individuals must complete the registration process on the Platform when one of the conditions stipulated in Article (2) of these rules is met.
Plain-Language Explanation
The explanation below is provided to help you understand the SDAIA’s legal text and does not replace or override the official PDPL law, regulation, or guideline.
Article 4
Obligation to Complete Registration
Article 4(1)
Role of the Representative in Registration
Where a Controller is represented by a designated representative, that representative bears responsibility for completing the registration process on the Platform. This includes ensuring that all required information is accurately provided and maintained in accordance with the Rules and applicable regulations.
In addition to completing registration, the representative is required to assess whether the Controller is obligated to appoint a Personal Data Protection Officer (DPO). This assessment must be conducted in accordance with Article 32 of the Implementing Regulation of the Personal Data Protection Law and the applicable rules governing the appointment of a Personal Data Protection Officer.
