AutoSmart GuidebooksWhat this guidebook covers
Every customer a dealership serves leaves personal data behind: IDs, contact details, finance papers and service history. The PDPL's grace period ended on 14 September 2024, and on 16 January 2026 SDAIA announced 48 decisions confirming violations, naming four recurring failures: no legal basis, unjustified disclosure, weak security and marketing without consent.
This guidebook covers 12 PDPL standards with 29 checkpoints, from privacy notices and consent records to processing records, breach notification, data subject requests, processor contracts, cross-border transfers and the physical security of customer files.
The 12 PDPL standards
Open a standard to see the law behind it, what is checked, what it can cost and the evidence. Ideal fix times are counted from audit submission.
DAT-001PDPL awareness materials displayed7 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · No article requires a poster: it is company policy and the visible sign of an awareness programme · Penalty provisions: PDPL Art. 35 & 36
- What we check
- PDPL awareness material, in the company's approved format, is displayed where every employee and visitor can see it.
- What it can cost
- The poster costs nothing. The mistakes an untrained team makes (a forwarded customer list, an unconsented offer blast) cost up to SAR 5 million each.
- Evidence
- Photo of displayed material + notes of staff answers
DAT-002Privacy notice at collection points72 hours
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 12 (privacy policy) and Art. 13 (information at collection) · Implementing Regulations Art. 4 & 18 · Penalty: PDPL Art. 36
- What we check
- Customers are told why their data is collected, on what legal basis, who receives it and what their rights are: on every form, on the website and wherever CCTV records them.
- What it can cost
- A missing camera sign was one of the findings behind a 1.1 million fine on Volkswagen. Under PDPL the same gap can cost up to SAR 5 million.
- Evidence
- Photos of forms + website screenshot + photo of each CCTV sign
DAT-003Lawful basis and consent records7 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 5 & 6 (consent and its exceptions) · Implementing Regulations (consent provisions) · Penalties: Art. 36, criminal offence Art. 35
- What we check
- Every use of customer data has a documented legal reason. Where that reason is consent, the dealership can produce it on demand. Sensitive and credit data needs explicit consent first.
- What it can cost
- A car maker paid SAR 47.8 million for using data without proper consent. Under PDPL, share sensitive data unlawfully and it's no longer only a fine: it's up to 2 years in prison.
- Evidence
- CRM screenshots of consent fields + signed F&I consent forms
DAT-004Marketing SMS and email consent24 hours
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 25 (marketing and awareness) · Implementing Regulations Art. 28-29 (advertising and direct marketing) · Penalty: PDPL Art. 36
- What we check
- Every promotional SMS, WhatsApp or email goes only to a customer who gave prior, recorded consent, and every message lets them stop it.
- What it can cost
- One offer blast to an unconsented list can bring an SDAIA decision of up to SAR 5 million, published with your name on it. Do it again after a warning: SAR 10 million.
- Evidence
- CRM consent export + screenshot of message with opt-out + suppression list entry
DAT-005Records of processing activities30 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 31 · Implementing Regulations Art. 33 · Penalty: PDPL Art. 36
- What we check
- A Record of Processing Activities (ROPA) lists every way the dealership uses personal data: why, what data, who receives it, how long it's kept and how it's protected.
- What it can cost
- It's the first document SDAIA will ask for. Missing or out of date, you've failed before the inspection starts, with a ceiling of SAR 5 million.
- Evidence
- Copy of the ROPA with review date + 3 traced process samples
DAT-006DPO appointment and SDAIA registration30 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 30(2) · Implementing Regulations Art. 32 (DPO) & Art. 34 (registration) · SDAIA Rules for Appointing a DPO · SDAIA Registration Rules
- What we check
- Where the rules require it, a Data Protection Officer is formally appointed and the entity is registered on SDAIA's National Data Governance Platform with a valid certificate.
- What it can cost
- With no DPO, nobody reports a breach in 72 hours or answers a customer in 30 days. Every missed deadline is another violation of up to SAR 5 million.
- Evidence
- Appointment letter + registration certificate + assessment memo
DAT-007Data retention and destruction30 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 18 (destruction when no longer necessary) · Penalty: PDPL Art. 36
- What we check
- Personal data is kept only as long as it's needed. An approved schedule says how long, and data past that date is securely destroyed and logged.
- What it can cost
- A leak of data you should have deleted years ago can be two violations, not one: keeping it, and failing to protect it. Up to SAR 5 million each.
- Evidence
- Retention schedule + photos of archive + destruction log extract
DAT-008Personal data breach notification7 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 20 · Implementing Regulations Art. 24 (notify within 72 hours via the SDAIA platform) · Penalty: PDPL Art. 36
- What we check
- When personal data leaks, SDAIA is notified within 72 hours and affected customers are told where needed. A written procedure and an incident register make that possible.
- What it can cost
- The breach is one problem. Hiding it is another: a missed 72-hour deadline is a separate violation, up to SAR 5 million, and SAR 10 million if it happens again.
- Evidence
- Procedure + register extract + any SDAIA notification receipts
DAT-009Data subject request handling7 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 4 (data subject rights) · Implementing Regulations (30-day response, extendable once) · Penalty: PDPL Art. 36
- What we check
- Customers have an easy, published way to ask for access to, correction of or deletion of their data, and every request is answered within 30 days.
- What it can cost
- Two car makers paid SAR 3.8 million combined for making privacy requests hard. Ignoring them entirely under PDPL: up to SAR 5 million.
- Evidence
- Screenshot of channel + request log extract + test request result
DAT-010Data processor contracts30 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 8 (selection of processors) · Implementing Regulations (processor agreements) · Penalty: PDPL Art. 36
- What we check
- Every vendor that handles customer or employee data (call centre, CRM, DMS, payroll, marketing agency) works under a written agreement covering purpose, security and PDPL.
- What it can cost
- Your vendor's leak is your violation. With no contract, you can't show you did anything to prevent it, and the ceiling is SAR 5 million.
- Evidence
- Vendor list + 3 agreement copies with the clauses marked
DAT-011Cross-border data transfers30 days
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 29 · Regulations on Personal Data Transfer outside the Kingdom (SDAIA) · Penalty: PDPL Art. 36
- What we check
- Every flow of personal data out of Saudi Arabia is known, each one has an approved safeguard, and a risk assessment is on file where the rules require one.
- What it can cost
- Every customer file sent abroad without a safeguard is unlawful processing: a ceiling of SAR 5 million, doubling to SAR 10 million on repeat.
- Evidence
- Transfer map + safeguard documents + risk assessment
DAT-012Physical security of customer filesImmediate
- The law
- Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H) and its Implementing Regulations · Art. 19 (security measures) and Art. 28 (copying official identification documents) · Penalties: Art. 36, criminal offence Art. 35
- What we check
- Paper files are locked away, desks and printers are clear, and ID, Iqama or passport copies are only taken where a law or competent authority requires it.
- What it can cost
- An ID copy on a counter looks harmless until it's misused. The fine ceiling is SAR 5 million, and deliberate disclosure of sensitive data can mean 2 years in prison.
- Evidence
- Photos of desks, cabinets and printer trays + sample file check
How to run a PDPL compliance audit, step by step
- Confirm what applies. Map where the site collects personal data (showroom, service reception, finance desk, website, CRM) and which vendors receive it.
- Walk the site, standard by standard. Score each of the 29 checkpoints Pass, Fail or N/A. N/A only where the standard rules it out, with the reason recorded. Sample deal files and marketing lists, and check each has a lawful basis or consent record.
- Capture the evidence. A pass counts only with proof captured at the time of the audit: the privacy notice at each collection point, consent records, the processing register, processor contracts and photos of where files are kept.
- Give every fail an owner and a fix time. Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).
- Fix it, then prove it. The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.
- Re-check at the next audit. Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.
Who this guidebook is for
- Dealer principals
- Data protection officers
- Compliance officers
- Auditors
A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.
