SDAIA and Saudi PDPL: AI Deployment Checklist for SMEs
SDAIA is Saudi Arabia’s national data and AI authority and the competent authority for the Personal Data Protection Law. Treat privacy as part of the implementation scope: an AI vendor’s claim of “PDPL-ready” does not establish your compliance.
Identify the data and lawful processing basis
List what the system collects, why, who uses it and every place it is stored or processed. Under PDPL and its regulations, consent is one basis; Article 6 also describes cases where consent is not required, including certain legal or contractual processing and restricted legitimate-interest processing. Do not describe explicit consent as the universal basis for every task. The implementing regulation requires explicit consent in specified cases, including sensitive or credit data and solely automated decisions.
A recording notice informs the caller; it does not by itself demonstrate a valid consent action. Where consent is the basis, document a valid choice, purpose and withdrawal route. Keep routine service messages distinct from marketing and obtain the relevant permission for marketing.
Review the whole vendor chain
- Map telephony, transcription, model inference, CRM, analytics, backups and supplier support access.
- Confirm processor obligations, subprocessors, locations, retention and incident reporting in writing.
- Give the system only the data and access necessary for the task. Test correction, access and deletion requests across each store.
- For health data, review the additional controls and applicable health-sector requirements; a general chatbot checklist is insufficient.
International transfers need a separate assessment
Local storage can reduce transfers, but does not prevent foreign inference or remote support access. Review the transfer purpose, minimum data, destination protection, applicable safeguards and required risk assessment under the current official regulations. Do not treat ordinary vendor terms or explicit consent alone as a blanket exemption from transfer requirements.
Retention, rights and incident response
Set justified retention periods for each data category; account for applicable record-keeping duties and deletion exceptions. Withdrawal of consent and a deletion request are different actions. Confirm identity proportionately, record the request and assess which data must be retained under another lawful obligation.
Article 24 of the implementing regulation requires notification to the competent authority within 72 hours of awareness where the incident potentially harms personal data or the individual, or conflicts with their rights or interests. Assess the threshold and document the decision; do not wait for full certainty before investigating. Affected individuals must be notified without undue delay when the relevant harm condition applies.
Before launch
- Name the controller’s owner and assess whether a DPO or impact assessment is required.
- Approve the data-flow inventory, privacy notice, processing basis and vendor agreements.
- Test retention, access controls, subject requests and international transfer safeguards.
- Rehearse an incident with named decision-makers, supplier contacts and a reporting path.
- Set a review date after a change in the model, supplier, data use or integration.
This is an operational checklist, not a legal determination. Use qualified advice for sensitive data, sector obligations or uncertain transfer arrangements. SDAIA’s policy role does not mean that every SME deployment needs a general AI certificate or receives government funding.
Plan a practical implementation
Discuss your project scope, with costs, controls and responsibilities defined before launch.