What is the PDPL compliance checklist for a website?

Six steps: list the data you collect and the tags you run, publish an Arabic privacy policy, ask consent before analytics and advertising tags run and record it, answer data requests within 30 days, notify SDAIA within 72 hours of a breach that could cause harm, and check every transfer of data outside the Kingdom.

Behind those steps sit three kinds of record. A record of processing that SDAIA can ask for: purposes, who the data is about, who receives it, transfers abroad and retention periods (Article 31). An impact assessment when you process sensitive data, link datasets from different sources or monitor people constantly (Implementing Regulation, Article 25). And a written data processing agreement with each vendor that processes data for you, from the platform to payment, shipping, email and analytics tools.

A data protection officer is required only in three cases (Implementing Regulation, Article 32), and most small and mid-sized businesses fall outside all three. Have the records ready before anyone asks: once SDAIA formally notifies an organisation of an alleged violation, it has five days to respond.