Personal Data Processing Activities Records Guideline
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
This guideline assists organizations subject to Saudi Arabia's Personal Data Protection Law in creating and maintaining records of their data processing activities. It outlines mandatory content requirements for such records, including controller details, processing purposes, data categories, retention periods, and security measures. The guideline provides a sample template with mandatory and optional fields to help controllers document their personal data processing activities comprehensively.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
6 sections
Jump to a chapter
Introduction
SDAIA issued this non-binding guideline to help entities understand their obligations to keep records of personal data processing activities under the Personal Data Protection Law and its regulations. The guideline provides a sample template to assist controllers in preparing these records and should be read alongside the law and regulations, not as a substitute for them.
Objectives
The guideline seeks to support entities in applying the law, promote adoption of data protection best practices, describe key elements for record preparation, and safeguard the privacy rights of data subjects.
First: Personal Data Processing Activities Records Requirements
Controllers must maintain records of their processing activities and provide them to the competent authority upon request. Records must be kept for five years after each processing activity ends, documented in written form, kept current and accurate, and made available to authorities when requested.
Second: Contents of Personal Data Processing Activities Records
At minimum, records must include the controller's details, data protection officer information if applicable, processing purposes, categories of data and data subjects, retention periods, recipient entities, details of transfers outside the kingdom, and technical and organizational security measures.
Third: Content Details of Personal Data Processing Activities Records
Records of personal data processing activities must document controller and officer details, all processing activities with descriptions of their impact and risks, mandatory fields including activity dates, responsible business unit, processing purpose, legal basis, data subject and data type categories, dataset names and owners, storage locations, retention periods, disclosure recipients, data processors, processor obligations, cross-border transfers, security measures, consent procedures, and procedures enabling data subject rights, alongside regular reviews and updates triggered by new activities, new purposes, or changes to existing activities, legal basis, processing purpose, or data categories. Records must also include when applicable sensitive data categories, linked datasets from different sources, number of affected data subjects, large-scale processing characteristics, processing frequency, novel technology use, automated decision-making, and processing embedded in products or services. Records must further describe personal data processing within publicly offered products or services, breach reporting procedures, impact assessment reasons and mandatory or optional status, findings and remedial actions after data breaches, date of last assessment, assessment report reference, and summary of findings.
Fourth: Sample Template
This section provides a sample table demonstrating how to document processing activities, showing examples of categories of processed personal data and data subjects involved in different processing purposes such as employee data management and direct marketing.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 7 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
Data and privacy 2 of 4
- Data subject rights and consent, not covered
- Copyright and training data, not covered
Transparency and records 1 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 1 of 4
- Human oversight, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 14 are shown.
Objectives 1 control
- Applies to: AnyoneDrafted by the Index
Entities should implement the personal data protection law provisions and adopt best practices when preparing their processing activity records.
First: Personal Data Processing Activities Records Requirements 4 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must maintain records of their personal data processing activities and make them available to the competent authority upon request.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must keep records of personal data processing activities for five years after each processing activity ends.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must document their personal data processing activity records in written form.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must keep their personal data processing activity records accurate and up to date.
Second: Contents of Personal Data Processing Activities Records 4 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must include in their processing activity records the controller's name, contact details, and data protection officer information where required.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must document the purposes, categories of personal data and data subjects, retention periods, and recipient entities in their processing activity records.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must describe in their processing activity records any transfers of personal data outside the Kingdom, including the legal basis and recipient entities.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should describe the organizational, administrative and technical security measures in place to protect personal data in their processing activity records.
Third: Content Details of Personal Data Processing Activities Records 5 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers should document a comprehensive record for each personal data processing activity using a structured template covering controller name, data protection officer details, activity identification, dates, responsible business units, purposes, legal bases, data and subject categories, datasets, storage locations, and retention schedules.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should specify how long personal data in each type will be kept before deletion or destruction.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should record the entities that have received or will receive their personal data.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should record processor details and the obligations between controllers and processors when processing is carried out on behalf of the controller.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should use the template to document an impact assessment process when their processing activities require one.
Applies when: requires an impact assessment
Change history
No changes recorded since we began monitoring this policy.