5 steps to comply with the PDPL on your website

The Personal Data Protection Law (PDPL) is in force, and SDAIA enforces it. If your site collects visitor data, you are a controller. This is the order we recommend. It is not legal advice.

Know what the site collects

Personal data is anything that identifies a person, directly or not (article 1). That includes cookies and analytics, not only what people type into forms.

Collect only what the purpose needs (article 11). List it before you write anything:

• What visitors type into signup, checkout and contact forms
• Payment data, and who processes it with you
• Cookies, analytics and ad tools
• Everyone who receives the data, inside or outside the Kingdom

The cart and the login serve the visitor. Analytics and ads serve you, and they need consent.

Ask before you track

You need consent unless an exception in article 6 applies, such as carrying out an agreement with the person. Valid consent is free, specific and recorded, and it is separate for each purpose (article 11 of the regulations). One box for analytics, ads and email is not enough.

Withdrawing consent has to be as easy as giving it, or easier

Article 12 of the regulations

On a site that means four things. No tracker loads before the choice. Reject sits next to accept. Each purpose has its own switch. The visitor can change their mind in the same place.

Do not make consent a condition of using the site (article 7), and do not send marketing messages without it (article 25).

Publish a privacy policy people can find

Publish the policy before you collect (article 12). It states the purpose, the data, and how you collect, store, process and destroy it. It also covers the person’s rights and how they use them.

Link it in the footer and on checkout, before the order is placed. What a store policy has to say goes through it item by item.

Be ready to answer requests

People can ask to see their data, get a free copy, correct it, or have it destroyed (article 4). You answer within 30 days. You can extend once by 30 more if you tell them why before the first period ends (article 3 of the regulations).

Check who is asking, keep a record of every request, and publish one contact that someone reads. The 30-day deletion request walks through one case.

Keep a record that shows the work

Article 31 requires a record of processing. It lists the purposes, the data categories, who receives the data, transfers abroad, retention periods and how you protect it. Keep it up to date and for five years after the processing ends.

Add the consent log and the request log. Destroy data once its purpose ends, unless another law says to keep it, like an invoice (article 18).

If a breach could harm people, tell SDAIA within 72 hours (article 24 of the regulations), and tell the people affected without delay when the harm is serious.

References

1. PDPL Implementing Regulationsdgp.sdaia.gov.sa
2. SDAIA personal data protection portaldgp.sdaia.gov.sa
3. A visitor asked you to delete their dataBlog
4. What an online store's privacy policy has to sayBlog