PROCESSORS GUIDE

How to Assess a Processor before Onboarding

Review processing scope, role, locations, access, sub-processors, safeguards and contractual readiness before Personal Data is placed with a Processor or third party.

Use the working sequence below to connect the decision to operating implications, retained evidence and the point where specialist DPO support may be required.

Prepared by DPO Arabia

Practical KSA PDPL guidance, not organisation-specific legal advice.

KSA PDPL GUIDE

Assess the processor before Personal Data is placed in its hands.

The Guide frames the processing need, due diligence, contractual controls, access model and transfer implications that should be resolved before onboarding. The organisation-specific conclusion should be validated before implementation.

USE THIS WHEN

Use before approving a new processor or materially changing an existing processor relationship.

This becomes relevant when a new vendor is proposed, scope expands, subprocessors change, hosting moves or foreign support access is introduced.

HAVE READY

Bring the processing scope, vendor evidence, hosting model and draft contract.

Useful inputs include the questionnaire, security evidence, data locations, subprocessors, access routes, retention terms and proposed Data Processing Agreement (DPA) available.

OUTCOME

Finish with a documented onboarding decision and the controls required before processing starts.

A complete evidence set retains due diligence, risk findings, DPA status, transfer safeguards, approvals, remediation actions and review triggers.

HOW TO USE THIS GUIDE

Use the Guide to frame the decisions before implementation.

This Guide highlights the decisions, evidence and operating interfaces that should be resolved before the requirement is treated as complete.

Use it to understand the issue, challenge the relevant facts and identify where organisation-specific legal, operational or technical input is needed.

GUIDE OUTCOME

An onboarding decision backed by due diligence, contract controls and transfer safeguards.

The objective is a defensible decision and an operating control, not simply a completed template or document.

QUESTIONS TO RESOLVE

What should the DPO Office establish?

PROCESSOR ONBOARDING CHECKPOINT

What Personal Data will the provider process, for what purpose, and through which systems or services?

Does the provider act as a Processor, independent Controller, or another role for this activity?

Where will Personal Data be hosted, accessed, supported, backed up or sub-processed?

Does the provider offer sufficient privacy, security, contractual and operational guarantees for the processing?

What DPA, transfer safeguards, remediation and approval conditions must be completed before onboarding?

WORKING STEPS

Use the sequence to identify the decisions that need to be resolved.

Understand the service

Understand the actual processing before reviewing contractual documents. Map what the provider will do with Personal Data, why the service is needed and how the processing fits into the organisation’s operating environment.

What to validate in practice

Confirm the business purpose for engaging the provider, the service being delivered and the accountable business owner.
Identify the Personal Data categories, Data Subject categories, processing operations, systems and integrations involved.
Confirm whether production Personal Data is actually required and whether the processing scope is limited to what the service needs.
Document expected retention, return and deletion arrangements, including what happens when the service or contract ends.
Identify whether the provider is replacing an existing Processor, system or processing arrangement so downstream records can be updated.

DPO Arabia service

WHAT NOT TO DO

Do not start with the Processor questionnaire or DPA and assume the processing scope is understood. Establish the real service and Personal Data flow first.

Confirm the role

Determine the provider’s role from the actual allocation of purposes, instructions and decision-making. A commercial supplier label does not by itself establish that the provider is a Processor.

What to validate in practice

Confirm whether the provider processes Personal Data for the benefit and on behalf of the Controller and follows documented instructions.
Assess whether the provider determines its own processing purposes or essential means for any part of the service.
Identify whether the arrangement is Processor, independent Controller or a mixed-role relationship depending on the activity.
Confirm whether sub-processors or other downstream parties participate in the processing and how their roles are governed.
Confirm that the contracting entity is the entity actually delivering the processing and that the contractual role matches operational reality.

DPO Arabia service

DPO CHECK

A provider is not automatically a Processor because it is treated commercially as a supplier. Determine the role from who decides the purpose and how the Personal Data is processed.

Map locations and access

Map every location from which Personal Data may be hosted, accessed, supported, administered, backed up or sub-processed. KSA hosting alone does not establish that processing stays within the Kingdom.

What to validate in practice

Confirm the primary hosting location and any disaster recovery, backup or archival locations.
Identify remote support, administration and employee access locations, including access used for troubleshooting or maintenance.
Map sub-Processor locations and any onward processing or access in the service chain.
Assess whether Personal Data is transferred outside the Kingdom or may be accessed from outside the Kingdom even when primary hosting remains in KSA.
Assess whether Personal Data is transferred outside the Kingdom or may be accessed from outside the Kingdom even when primary hosting remains in KSA.

DPO Arabia service

EVIDENCE TIP

Retain architecture, hosting, support and sub-Processor evidence. A questionnaire answer should be traceable to the actual service configuration and access model.

Assess guarantees

Assess whether the provider offers sufficient privacy, security, contractual and operational guarantees to protect Personal Data and support the Controller’s PDPL obligations throughout the processing lifecycle.

What to validate in practice

Review privacy governance, confidentiality, access management, security controls and encryption where appropriate to the processing.
Confirm breach notification support, Data Subject Rights assistance and the provider's ability to follow the Controller's documented instructions.
Assess sub-Processor governance, prior acceptance mechanisms and whether downstream safeguards maintain the required level of protection.
Validate retention, return and deletion controls, including backups, termination handling and evidence of deletion where required.
Review audit rights, certifications or independent assurance, business continuity and other evidence supporting the provider's guarantees.
Identify gaps that must be remediated before onboarding and distinguish them from controls that can be monitored during the relationship.

DPO Arabia service

CHANGE TRIGGER

Reassess the guarantees when the service, Personal Data, sub-processors, hosting, support model, security posture or contractual terms materially change.

Set onboarding conditions

Record whether the provider is approved, rejected or conditionally approved, and define every privacy, contractual, transfer and remediation condition that must be satisfied before production Personal Data is processed.

What to validate in practice

Record the Processor screening outcome, accountable approver and whether onboarding is approved, rejected or conditional.
Define the DPA requirement and any contractual gaps that must be resolved before processing starts.
Where international processing or access exists, determine the required transfer assessment and safeguards, including TIA / TRA and SDAIA SCCs where applicable.
Assign remediation actions, owners and target dates, and identify which conditions are go-live dependencies.
Update the Processor Register and define review dates and reassessment triggers for changes in service, locations, sub-processors or risk.
Confirm closure evidence for every pre-go-live condition. Conditional approval is not completed onboarding until required conditions are satisfied.

DPO Arabia service

OPERATING TIP

Conditional approval is not the same as completed onboarding. Pre-go-live conditions should have accountable owners and retained evidence of closure before Personal Data processing begins.

EVIDENCE TO RETAIN

Know what evidence should remain after the work is complete.

Retain the processor questionnaire, security and privacy evidence, risk assessment, DPA status, subprocessor and location details, transfer safeguards, approval decision and follow-up actions.

RETAINED EVIDENCE SET

Keep the due-diligence record, role analysis and contractual safeguards together.

Retain approval conditions and evidence that onboarding gaps were closed.

Completed Processor screening assessment

Processing scope and purpose

Controller / Processor role determination

Business owner confirmation

Personal Data and Data Subject mapping

Hosting and access-location evidence

Sub-Processor inventory

Security and privacy assurance evidence

Breach and DSR-support assessment

Retention / deletion assessment

DPA review and execution evidence

Transfer assessment, where applicable

TIA / TRA, where applicable

SDAIA SCCs or other transfer safeguard, where applicable

Remediation actions and owners

Onboarding approval / rejection decision

Processor Register entry

Review and reassessment trigger

BEFORE YOU CLOSE THE WORKFLOW

Validate the operating position, not only the document.

Before closing processor onboarding, confirm that the processing scope is understood, due diligence is complete, contractual obligations are agreed, transfer requirements are resolved and outstanding actions have owners.

Use the checks below to test whether the organisation could explain why this processor was approved and which controls must remain in place throughout the relationship.

The processing scope, business purpose and provider role are confirmed against the actual service. Hosting, support, access and sub-Processor locations are evidenced and international access has been assessed. Sufficient privacy, security, contractual and operational guarantees have been assessed and documented. DPA and applicable cross-border transfer requirements are completed before production processing begins. DPA and applicable cross-border transfer requirements are completed before production processing begins.

FROM GUIDANCE TO OPERATION

Connect the decision to the wider DPO Office.

Processor onboarding becomes operational when due diligence, the DPA, transfer controls, subprocessor changes, incidents and periodic review stay connected. Use this handoff to keep the processor relationship governed after approval.

Apply the DPO guide

Use the guide to define the processing scope, review due diligence, identify risks, confirm contract requirements and document the onboarding decision.

Connect the controls

Connect the Processor decision to the Record of Processing Activities (RoPA), Processor Register, DPA, sub-Processor records, transfer assessment, Standard Contractual Clauses (SCCs) and remediation actions so onboarding remains traceable from due diligence through ongoing review.

SPECIALIST SUPPORT

Get specialist support

Use DPO Arabia to conduct processor due diligence, review DPAs, assess international access, define remediation actions or support high-risk onboarding decisions.

GUIDE STEPS

Use these sections as your working path through the DPO guide. If a processing fact is unknown, record it for clarification rather than guessing.

How to use this guide

Questions to resolve

Working steps

Understand the service

Confirm the role

Map locations and access

Assess guarantees

Set onboarding conditions

Evidence to retain

Before you close

From guidance to operation

READY TO OPERATIONALISE IT?

Need to turn the guidance into an operating DPO Office control?

DPO Arabia can apply the Guide to your organisation’s actual processing, decisions and evidence, then implement and operate the resulting control through the appropriate DPO Office service.