Fifty questions covering eight categories of the Personal Data Protection Law — the same eight categories SDAIA enforcement actions have concentrated on. Each item scores Yes / Partial / No against the obligations the law imposes on Controllers and Processors. Scoring runs live as you work through the items; results persist locally so you can return to them. Unlike DPDP's still-implementing posture, KSA PDPL is fully enforced and SDAIA is actively imposing penalties. The output is a current readiness percentage, category-level gap analysis, and a maturity band that tells you where you actually stand against an enforcement regime that is already operating.
SDAIA's National Data Governance Platform (NDGP) is the operational mechanism through which the regulator monitors compliance. DPO obligation determination and NDGP registration are typically the first questions enforcement officers ask. Get these wrong and the rest of the assessment becomes academic.
SDAIA publishes a four-tier data classification framework that drives the protection requirements applied to each data category. Applying that classification to your inventory is not optional — it is the foundational step that determines which assets require the most rigorous protections and structures every subsequent compliance decision.
"Processing without lawful basis" is the single most common SDAIA violation finding among the 48 enforcement decisions issued in 2025-2026. Lawful basis quality is the most heavily weighted category — failure here typically means the entire processing operation lacks legal foundation.
Data subject rights are operational obligations with strict timelines. PDPL grants rights to access, correct, delete, restrict processing, and withdraw consent. Default response window is 30 days; SDAIA may require response within 10 business days for specific cases. Failure to honour rights triggers enforcement.
PDPL Article 19 requires "reasonable security safeguards" — interpreted in practice against ISO 27001 / CIS Controls / NCA Essential Cybersecurity Controls baselines. SDAIA enforcement findings have repeatedly cited "failure to implement proper technical and organisational safeguards" as a primary violation.
PDPL Art. 20 imposes strict breach notification obligations: 72-hour notification to SDAIA. Failure to notify is itself a violation — separately penalisable from the underlying breach. SDAIA's enforcement priorities have repeatedly emphasised breach notification compliance.
PDPL Art. 29 governs cross-border data transfers and is materially stricter than equivalent international frameworks. SDAIA has not published an adequacy country list — meaning all transfers outside KSA require explicit transfer mechanisms or specific exceptions. Cross-border governance is one of the most operationally complex PDPL areas.
Under PDPL the Controller remains accountable for processor actions. Combined with retention discipline, this category covers the operational backbone of compliance — the things that frequently break first when programmes lose discipline. Lower weighted because gaps here are typically remediable; higher-weighted categories represent more existential failures.
The composite score below weights each category by SDAIA enforcement focus — not all 50 items count equally. Lawful-basis and consent failures carry the highest weight because SDAIA's 48 enforcement decisions concentrated heavily there. Cross-border transfer failures and SDAIA notification failures are next. Vendor and retention items are weighted lower not because they don't matter, but because they are typically remediable with focused effort.
Your composite score will appear here as you answer items. PDPL is fully enforced and SDAIA is actively imposing penalties — under-scoring is more useful than over-scoring; the goal is an honest baseline, not a flattering one.
Each item scores Yes (full credit) / Partial (half credit) / No (zero). Items within a category sum to the category's weighted contribution. The maturity bands below reflect active enforcement reality — not a future deadline. Items flagged as "SDAIA enforcement priority" represent areas where SDAIA's 48 enforcement decisions have most consistently focused.
| Band | Score | Interpretation in active enforcement context |
|---|---|---|
| Acute exposure | Below 30% | Substantial PDPL gaps across most categories with material enforcement risk. Civil penalties up to SAR 5 million per breach are real, not theoretical. Treat as urgent — not a build over months but a focused 60 — 90 day remediation sprint on enforcement-priority items first. |
| Catching up | 30 — 55% | Foundation visible, core gaps remain. Typical state for organisations that started PDPL work after the September 2024 enforcement deadline rather than before. Realistic 6-month focused remediation; concentrate first on lawful basis, NDGP registration, marketing consent. |
| Operationally compliant | 55 — 75% | Most obligations operational; specific gaps remain. Typical state for organisations with mature data protection programmes. The gap-closing work is targeted; the core programme exists. SDAIA inspection would identify specific findings rather than systemic failures. |
| Audit-ready | 75 — 90% | Programme operating at near-full coverage. Remaining gaps are usually specific high-effort items: full backup-retention alignment, end-to-end erasure propagation, sophisticated cross-border transfer mechanisms. Stands up to SDAIA inspection scrutiny. |
| PDPL-mature | Above 90% | Comprehensive operational compliance. Maintenance discipline rather than build effort. Honest 90%+ self-assessments are uncommon — under-scoring is more useful than over-scoring. Most KSA organisations on this band are also pursuing ISO 27701 certification. |
This tool is a working baseline, not a regulatory determination. SDAIA determines compliance through formal investigation; nothing here substitutes for that. The tool's value is in honest internal assessment — identifying where remediation effort should concentrate before the next enforcement decision affects you. For substantive review of your PDPL posture or response to active SDAIA scrutiny, a Readiness Review or DPO-as-a-Service engagement is the natural next step.
SDAIA has issued 48 violation decisions in the past year. The question is no longer whether enforcement will happen — it is whether your organisation is positioned to withstand it. If your score reveals gaps you cannot close internally, a 30-minute scoping call costs nothing — we will tell you honestly whether the gap is closeable with focused effort or requires a substantial programme, and what realistic remediation looks like for your specific situation.
Schedule a call