Personal Data Protection Law

Who it applies to

Any organisation processing personal data of individuals in the Kingdom, including processing carried out abroad on their behalf.

What internal audit has to show

Audit looks at the processing inventory, lawful basis, consent and notice, data subject rights handling, cross-border transfers, breach handling and the role of the data protection officer.

What Oversight does with PDPL

• Turns your records of processing, policies and notices into an audit universe of processing activities by department.
• Drafts review programs for the law and its implementing regulations with the evidence each obligation requires.
• Requests evidence from data owners and tracks it, including the handling of rights requests and breach records.
• Drafts findings with the source document attached and carries open actions into the committee pack.

Typical engagements

• Personal data protection compliance review
• Data subject rights handling review
• Cross-border transfer and processor oversight review