PDPL — Saudi Data Subject Access Request Operational Playbook The Personal Data Protection Law (PDPL) is in force in Saudi Arabia. Most KSA companies have published a privacy policy and added cookie consent banners. Far fewer have actually operationalized the data subject rights process — the workflow that fires when a Saudi customer submits a […]

SAMA Cybersecurity Framework — Quarterly Self-Assessment Checklist The Saudi Central Bank (SAMA) Cybersecurity Framework requires quarterly self-assessment by all SAMA-regulated entities — banks, finance companies, insurance companies, payment service providers, and fintech operating under SAMA licence. The framework is comprehensive: four domains, 24 sub-domains, and over 130 specific controls. Despite the quarterly requirement, most KSA […]

NCA Critical Sectors Cybersecurity Controls — KSA Implementation Guide If you run an enterprise in Saudi Arabia in a sector the National Cybersecurity Authority (NCA) designates as critical — banking, energy, telecom, healthcare, government, transport — the Critical Sectors Cybersecurity Controls (CSCC) define the security baseline you must operate against. Combined with the Essential Cybersecurity […]