What this checklist covers
The PDPL Data Privacy Compliance Checklist is a 15-point scorecard for personal data collection, consent, privacy notices, data sharing, retention, and PDPL controller obligations. Each criterion is scored from 1 to 5 on what the auditor sees on the day, and every gap goes into an action plan with an owner and a close date.
AutoSmart tip: Saudi PDPL (Personal Data Protection Law) enforcement is overseen by SDAIA and carries financial penalties for non-compliance. Customer data collected through the DMS, CRM, service history, and marketing systems all falls within PDPL scope. Pay particular attention to marketing consent — using customer data for promotional communications without documented consent is one of the most common compliance gaps in dealership environments.
The checks
Tap Yes, No or Maybe to try it: your answers stay in this page and clear when you refresh. For a detailed walkthrough, download our PDF or book a demo.
Personal data collection and consent
- Is personal data collected from customers only for specified, explicit, and legitimate purposes as required under Saudi PDPL (issued by Royal Decree M/19)?
- Is customer consent obtained before collecting personal data used for non-essential purposes (e.g., marketing communications, data sharing with third parties)?
- Is the basis for processing each category of personal data documented (consent, contract performance, legal obligation, legitimate interest), consistent with PDPL requirements?
- Is sensitive personal data (as defined by PDPL) identified and subject to heightened protection measures, collected only with explicit consent or specific legal basis?
Privacy notices and data sharing
- Is a privacy notice provided to customers at or before the point of data collection, covering the purposes of processing, data categories collected, and individual rights?
- Is the privacy notice written in plain Arabic (or dual Arabic/English), accessible to the customer, and current?
- Where personal data is shared with third parties (finance partners, insurers, OEM/distributor, marketing agencies), is the basis for sharing documented and compliant with PDPL?
- Are data processing agreements in place with third-party processors who handle personal data on behalf of the dealership?
Data retention and customer rights
- Is a data retention policy in place, defining how long different categories of personal data are kept and the basis for that retention period?
- Are personal data deleted or anonymised when the retention period expires, rather than retained indefinitely?
- Is a process in place to respond to customer requests to access, correct, or delete their personal data, within the timeframe required by PDPL?
Breach handling and controller obligations
- Is a documented personal data breach response process in place, covering detection, containment, assessment, notification, and remediation?
- Is the PDPL obligation to notify SDAIA (Saudi Data and AI Authority) of qualifying data breaches within the required timeframe understood and documented?
- Is a data protection awareness programme in place for staff who handle personal data, covering PDPL obligations relevant to their role?
- Is there a named Data Protection Officer or equivalent responsible person designated at the dealership or group level, accountable for PDPL compliance?
How to run it
How the scoring works
Before the visit, fill in the dealer or centre, the auditor, the date and the audit cycle. Then score each of the 15 checks from 1 to 5 on what you see on the day, not on what the site aims for, and add them up out of 75.
- 1Not in place
- 2Attempted
- 3Defined
- 4Managed
- 5Fully sustained
- Green60–75 · 80–100%Compliant. Keep the standard.
- Amber38–59 · 50–79%Improvement needed: a structured action plan within 30 days.
- Red0–37 · Below 50%Priority intervention, escalated to regional management.
Then close every gap
Each gap goes into the action plan tracker and moves through four stages until the auditor closes it.
- 1PendingOwner and close date set
- 2In progressWork under way, evidence gathered
- 3CompletedEvidence submitted for review
- 4ApprovedVerified and closed by the auditor
