The Rules Governing the National Register of Controllers Within the Kingdom
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
These rules establish requirements for entities and individuals to register as data controllers on the National Data Governance Platform. They specify registration procedures, obligations for representatives, and the scope of application under the Personal Data Protection Law. The rules also outline services available through the platform, including breach notification, privacy impact assessment, and compliance evaluation.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
14 sections
Jump to a chapter
Article 1 Definitions
Defines key terms for these Rules, including the register itself as a compilation of public, private and individual data handlers in the Kingdom to support monitoring and compliance assistance. Also defines representative as a natural person authorized to handle registration tasks on the Platform.
Article 2 Scope and Objective
Mandates registration on the Platform for any entity or individual that is a public body, engages in personal data processing as a main activity, processes sensitive data, or is a natural person processing personal data beyond personal or family use. The register aims to track compliance and provide data protection services.
Article 3 Controller Delegate Appointment
Public entities and private entities must appoint a representative through the registration form or Platform to act on their behalf, while individuals must serve as their own representatives and cannot delegate this role.
Article 4 Registration Procedures
Representatives must complete Platform registration when the conditions in Article 2 are met and should assess whether a Personal Data Protection Officer is required. Individuals must also complete Platform registration when applicable conditions are met.
Article 5 Profile Data
Representatives must supply entity data including logo, email and phone contacts, plus headquarters location, along with their own contact details. Individuals must provide their official email and contact number.
Article 6 Circumstances for Appointing a Personal Data
Controllers must designate one or more people as responsible for safeguarding personal data when the conditions set out in Article 32 of the Personal Data Protection Law and its implementation rules are met.
Article 7 Information of the Personal Data Protection Officer
When a controller designates a data protection officer under Article 6, the controller's representative must enter the officer's details into the platform. For officers who are employees or local contractors, the representative must submit national ID, date of birth, and work contact details. For offshore contractors, only name, email, and phone number are required.
Article 8 Obligations
Representatives must complete entity registration, fill in data protection officer information, supply chief data details if applicable, review compliance assessments, use Platform services if no officer is appointed, and keep entity data current. Individuals must register, use services and update their information. Appointed officers must use the services specified in Article 12.
Article 9 Representative Replacement
Public controllers must contact the Competent Authority through official Platform channels to replace a representative, while private controllers may use an online form to do so.
Article 10 Registration Certificate Issuance
A certificate is issued upon completion of registration containing entity or individual details, registration number, and QR code, valid for up to five years. The Authority must notify controllers at least thirty days before expiration, and controllers have a five-day grace period after expiration to request renewal before losing service access.
Article 11 Making Registration Certificate Available to the Public
Allows members of the public to check whether Controllers are registered in the national registry and confirm the authenticity of registration certificates without any preconditions. This transparency serves to protect personal data and build public trust in data protection services.
Article 12 Services Provided on the Platform
The platform offers four services for data protection: a breach notification service allowing Controllers to report incidents to the authority within 72 hours if harmful; a privacy impact assessment tool to analyze data processing effects; legal support for public entities to understand data protection law; and a compliance assessment service to evaluate adherence to standards and improve practices.
Article 13 Review and Amendment
The Competent Authority may review and amend these rules at any time as it deems necessary.
Article 14 Enforcement
These rules become effective upon publication on the Competent Authority's official website.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 10 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
Data and privacy 1 of 4
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 3 of 4
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 40 are shown.
Article 2 5 controls
- ObligationApplies to: ControllerDrafted by the Index
Public bodies must register on the national platform.
- ObligationApplies to: ControllerDrafted by the Index
Controllers whose primary business involves processing personal data must register on the platform.
- ObligationApplies to: ControllerDrafted by the Index
Controllers processing sensitive data must register on the platform.
- ObligationApplies to: AnyoneDrafted by the Index
Natural persons processing personal data beyond personal or family purposes must register on the platform.
- ObligationApplies to: Public authorityDrafted by the Index
The register shall track controller compliance and provide data protection services.
Article 3 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Public entities must appoint a representative through the registration form sent by the Competent Authority to handle registration tasks.
- ObligationApplies to: ControllerDrafted by the Index
Private entities must appoint a representative through the Platform by an authorized person to handle registration tasks.
- ProhibitionApplies to: OthersDrafted by the Index
Individuals serve as their own representatives and may not designate another person to represent them.
Article 4 3 controls
- ObligationApplies to: ControllerDrafted by the Index
Representatives must complete Platform registration when any of the conditions in Article 2 are met.
- Applies to: ControllerDrafted by the Index
Representatives should assess whether appointing a Personal Data Protection Officer is necessary under the Personal Data Protection Law's executive regulations.
- ObligationApplies to: OthersDrafted by the Index
Individuals must complete Platform registration when any of the conditions in Article 2 are met.
Article 5 3 controls
- ObligationApplies to: ControllerDrafted by the Index
A controller's representative must provide entity logo, official email, contact number and headquarters address.
- ObligationApplies to: ControllerDrafted by the Index
A controller's representative must supply their own official email and contact number.
- ObligationApplies to: AnyoneDrafted by the Index
Natural persons must supply their official email and contact number to the platform.
Article 6 1 control
- ObligationApplies to: ControllerDrafted by the Index
Controllers must appoint one or more individuals responsible for protecting personal data when the conditions in Article 32 of the Personal Data Protection Law are satisfied.
Applies when: when Article 32 conditions are met
Article 7 4 controls
- ObligationApplies to: ProviderDrafted by the Index
When a data protection officer is appointed, the representative must enter the officer's information onto the platform.
Applies when: if a data protection officer is appointed
- ObligationApplies to: ProviderDrafted by the Index
For employees or local contractor data protection officers, the representative must supply national ID number, date of birth and work contact details.
Applies when: employee or local contractor
- ObligationApplies to: ProviderDrafted by the Index
For offshore contractor data protection officers, the representative must supply name, official email and contact number only.
Applies when: contractor outside the Kingdom
- Applies to: ProviderDrafted by the Index
A representative may appoint themselves as the data protection officer if the controller appoints them in that role.
Article 8 8 controls
- ObligationApplies to: ProviderDrafted by the Index
Representatives must complete entity registration on the platform.
- ObligationApplies to: ProviderDrafted by the Index
Representatives must enter data protection officer information in accordance with Article 7.
- ObligationApplies to: ProviderDrafted by the Index
Representatives must submit information about the entity's chief data officer if one exists.
Applies when: if applicable
- ObligationApplies to: ProviderDrafted by the Index
Representatives must view and review compliance assessment results and platform services.
- ObligationApplies to: ProviderDrafted by the Index
Representatives must use platform services when no data protection officer has been appointed.
Applies when: if no data protection officer appointed
- ObligationApplies to: ProviderDrafted by the Index
Representatives must regularly update entity data to keep it current.
- ObligationApplies to: OthersDrafted by the Index
Individuals must complete the registration process on the platform.
- ObligationApplies to: OthersDrafted by the Index
Individuals must use platform services.
Article 9 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Public controllers must contact the Competent Authority through official Platform channels to replace their representative.
- Applies to: ControllerDrafted by the Index
Private controllers should use the online form on the Platform to replace their representative.
Article 10 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
The Competent Authority must issue a registration certificate upon completion of registration containing the entity or individual name, registration number, address, contact details and QR code.
- ObligationApplies to: Public authorityDrafted by the Index
The Competent Authority must notify controllers at least thirty days before their registration certificate expires.
Applies when: upon expiration approaching
- Applies to: ControllerDrafted by the Index
Controllers may continue to access Platform services for up to five days after their registration certificate expires.
- ObligationApplies to: ControllerDrafted by the Index
Controllers lose access to Platform services beyond the five-day grace period unless they submit a renewal request.
Article 11 1 control
- ObligationApplies to: Public authorityDrafted by the Index
The Competent Authority must allow the public to verify controller registration in the national registry and confirm the authenticity of registration certificates without imposing any preconditions.
Article 12 4 controls
- Applies to: ControllerDrafted by the Index
Controllers may use the Platform to notify the Competent Authority of a personal data breach incident within seventy-two hours of becoming aware of it, if the incident would harm personal data or data subjects or affect their rights or interests.
Applies when: breach occurs and may cause harm
- Applies to: ControllerDrafted by the Index
Controllers should use the Platform's privacy impact assessment tool to analyze the effects of personal data processing on products and services, identify regulatory justifications and assess processing risks.
- ObligationApplies to: Public authorityDrafted by the Index
The Competent Authority should provide legal support to public entities through the Platform to help them understand the Personal Data Protection Law and its implementing regulations.
- Applies to: ControllerDrafted by the Index
Controllers should use the Platform's compliance assessment service to periodically evaluate their adherence to standards and requirements, identify non-compliant practices and improve business procedures.
Article 13 1 control
- Applies to: Public authorityDrafted by the Index
The Competent Authority may review and amend these rules whenever it deems necessary.
Article 14 1 control
- ObligationApplies to: Public authorityDrafted by the Index
These rules take effect on the date they are published on the Competent Authority's official website.
Change history
No changes recorded since we began monitoring this policy.