SCCs GUIDE
How to Use Saudi Data & AI Authority (SDAIA) Standard Contractual Clauses
The Guide frames the transfer roles, applicable SDAIA Standard Contractual Clauses (SCCs) template, appendices and alignment with the underlying transfer assessment. The organisation-specific conclusion should be validated before execution.
Use the working sequence below to connect the decision to operating implications, retained evidence and the point where specialist DPO support may be required.
Prepared by DPO Arabia
Practical KSA PDPL guidance, not organisation-specific legal advice.
KSA PDPL GUIDE
Use the correct SDAIA SCCs for the actual transfer relationship.
Use this guide to identify the transfer roles, choose the correct SCCs template, complete the annexes and keep the clauses connected to the underlying transfer assessment.
USE THIS WHEN
Use when SCCs are required to support a cross-border transfer or foreign access arrangement.
Use when SCCs are required to support a cross-border transfer or foreign access arrangement.
HAVE READY
Use when SCCs are required to support a cross-border transfer or foreign access arrangement.
Have the exporter and importer details, data categories, purposes, recipients, security measures, retention terms and relevant transfer evidence available.
OUTCOME
Finish with executed SCCs that match the transfer and remain connected to the supporting safeguards.
Retain the signed clauses, completed annexes, transfer assessment, approvals, underlying contract and reassessment trigger.
HOW TO USE THIS GUIDE
Use the Guide to frame the decisions before implementation.
This Guide highlights the decisions, evidence and operating interfaces that should be resolved before the requirement is treated as complete.
Use it to understand the issue, challenge the relevant facts and identify where organisation-specific legal, operational or technical input is needed.
GUIDE OUTCOME
Executed SDAIA SCCs matched to the correct transfer roles, annexes and supporting transfer assessment.
The objective is a defensible decision and an operating control, not simply a completed template or document.
QUESTIONS TO RESOLVE
What should the DPO Office establish?
- MAP EXPORTER & IMPORTER
- SELECT SCCs template
- COMPLETE ANNEXES
- ASSESS TRANSFER RISK
- ADD SUPPLEMENTARY SAFEGUARDS
- GOVERN CHANGES
SCCs DECISION CHECKPOINT
01
Who is exporting and importing the Personal Data, and what role does each party perform for this transfer?
02
Which SDAIA SCCs template matches the actual Controller / Processor relationship?
03
Do the SCCs appendices accurately describe the Personal Data, purpose, locations, security measures and onward-transfer chain?
04
Are the Standard Contractual Clauses (SCCs) consistent with the TIA / TRA, Data Processing Agreement (DPA) / Data Sharing Agreement (DSA) and commercial agreement?
05
Have the SCCs been executed, registered and linked to appropriate reassessment triggers?
WORKING STEPS
Use the sequence to identify the decisions that need to be resolved.
Determine exporter and importer roles
Establish the exporting and importing entities and determine whether each acts as Controller or Processor for the specific transfer. The role must follow the actual processing, including any sub-processing or mixed-role arrangement, rather than the commercial label used in the contract.
The commercial label does not determine the SCCs template. The actual processing role does.
What to validate in practice
- Confirm the exporting entity, importing entity and the legal entity that actually receives or accesses the Personal Data.
- Determine whether each party acts as Controller or Processor for the relevant transfer, including where roles differ across separate processing activities.
- Identify Processor-to-sub-Processor and Processor-to-Controller transfers where applicable, and map any onward-transfer role combinations.
- Check that the role determination is consistent with the underlying DPA, DSA, RoPA and actual instructions or decision-making responsibilities.
DPO Arabia service
ROLE CHECK
Do not select an SCCs template from the counterparty name, commercial agreement or a previous transaction. Confirm the actual exporter and importer roles for this transfer first.
Select the correct SDAIA SCCs template
Select the Controller-to-Controller, Controller-to-Processor, Processor-to-Processor or Processor-to-Controller SDAIA SCCs template that matches the role combination established for the transfer. Confirm that SCCs are the safeguard being relied upon for the relevant transfer route.
Do not mix relationship templates or retrofit an EU SCCs template where SDAIA SCCs are required.
What to validate in practice
- Confirm whether the relationship is C2C, C2P, P2P or P2C for the Personal Data covered by the transfer.
- Check that the chosen SDAIA template corresponds exactly to that role combination and is not reused merely because it was selected for another counterparty.
- Confirm that SCCs are the appropriate safeguard for the transfer and that any separate role combinations are addressed correctly.
- Ensure no alternative contractual template is being treated as a substitute for the applicable SDAIA SCCs template.
DPO Arabia service
template CHECK
Where the same provider performs more than one role, separate the relevant processing and apply the template that matches each actual transfer relationship.
Complete the appendices against the actual transfer
Complete the SCCs appendices using verified transfer facts. Record the parties, Personal Data, Data Subjects, purpose, frequency, duration, locations, security measures, sub-processing and onward-transfer details so the clauses describe the actual transfer rather than a generic service relationship.
The SCCs appendices should describe this transfer, not a generic service relationship.
What to validate in practice
- Confirm the parties legal names, contact details, exporter/importer roles, transfer purpose and processing instructions where relevant.
- Confirm the parties legal names, contact details, exporter/importer roles, transfer purpose and processing instructions where relevant.
- Validate the technical and organisational security measures, retention and deletion arrangements, sub-processors and onward transfers.
- Check that the completed appendices are consistent with the RoPA, Processor assessment, TIA / TRA and underlying agreement, including any supplementary measures.
DPO Arabia service
EVIDENCE TIP
Retain the source records used to complete the appendices so the DPO Office can demonstrate that the clauses reflect the actual transfer facts.
Align SCCs with the TIA/TRA and commercial contract
Compare the SCCs with the TIA / TRA, DPA or DSA and commercial agreement. Resolve inconsistencies in parties, roles, locations, safeguards, onward transfers, retention, deletion, incident support and sub-processing before execution.
The SCCs are part of the safeguard framework, not a substitute for transfer-risk analysis.
What to validate in practice
- Confirm exporter/importer identity, roles, purpose, Personal Data, Data Subjects and processing locations are consistent across the SCCs and TIA / TRA.
- Align security controls, sub-processors, onward transfers, retention, deletion, DSR support and incident obligations with the DPA / DSA and service agreement.
- Check that supplementary measures identified by the TIA / TRA are reflected in the contractual and operational control set where required.
- Confirm that no commercial or contractual term contradicts, weakens or undermines the SCCs commitments.
DPO Arabia service
CONSISTENCY CHECK
Do not sign the SCCs while the TIA / TRA, DPA / DSA or commercial agreement describes a different location, role, safeguard or onward-transfer arrangement.
Execute, register and monitor
Execute the correct final SCCs version and connect it to the transfer governance record. Monitor changes in parties, roles, destinations, sub-processors, purposes and safeguards so material changes trigger reassessment and, where necessary, updated SCCs documentation.
Connect executed SCCs to the relevant contract register, transfer record, TIA / TRA and Record of Processing Activities (RoPA) according to the actual relationship.
What to validate in practice
- Connect executed SCCs to the relevant contract register, transfer record, TIA / TRA and Record of Processing Activities (RoPA) according to the actual relationship.
- Link the executed SCCs to the TIA / TRA, RoPA, transfer or disclosure record, relevant contract register and sub-Processor records.
- Record supplementary measures, contract owner, review date and any conditions that remain subject to ongoing monitoring.
- Define reassessment triggers for changes in destination, sub-Processor, role, processing purpose, security controls or applicable regulatory requirements.
DPO Arabia service
OPERATING TIP
Treat SCCs as a live transfer safeguard. A new destination, sub-Processor, role or material processing change should trigger review of the SCCs and linked TIA / TRA.
EVIDENCE TO RETAIN
Know what evidence should remain after the work is complete.
Retain the executed SCCs, completed annexes, role analysis, transfer assessment, underlying contract, security measures, approvals and review trigger that support the transfer mechanism.
RETAINED EVIDENCE SET
Keep the selected SCCs template, completed annexes and transfer assessment together.
Retain supplementary safeguards, approvals and evidence of later transfer changes.
SCCs applicability / safeguard decision
Exporter and importer role determination
Selected SDAIA SCCs template
Selected SDAIA SCCs template
Completed SCCs appendices
Party identity evidence
Transfer purpose and scope
Personal Data and Data Subject mapping
Hosting and access-location evidence
Security measures
Sub-Processor / onward-transfer mapping
TIA / TRA
Supplementary measures
Related DPA / DSA
Related commercial agreement
Internal approval
Executed SCCs
Signature and effective-date evidence
RoPA linkage
Transfer / disclosure register entry
Relevant contract-register linkage
Review date
Reassessment trigger and version history
BEFORE YOU CLOSE THE WORKFLOW
Validate the operating position, not only the document.
Before closing the SCCs workflow, confirm that the correct template is used, the annexes match the actual transfer, supporting safeguards are in place and the clauses remain consistent with the underlying contract and TIA / TRA.
Use the checks below to test whether the SCCs package can be relied on as an operational transfer safeguard rather than a detached signature document.
FROM GUIDANCE TO OPERATION
Connect the decision to the wider DPO Office.
SCCs remain effective only when the clauses, annexes, transfer assessment, underlying contract and reassessment triggers stay connected. Use this handoff to keep the transfer mechanism current inside the DPO Office.
01
Apply the DPO guide
Use the guide to confirm party roles, select the correct SCCs template, complete the annexes and reconcile the clauses with the transfer assessment and contract.
03
Connect the controls
Connect the executed SCCs to the TIA / TRA, RoPA, transfer and disclosure records, relevant DPA or DSA, commercial agreement, sub-Processor records and reassessment triggers so the safeguard remains aligned with the actual transfer.
03
SPECIALIST SUPPORT
Get specialist support
Use DPO Arabia to select or review SDAIA SCCs, complete annexes, resolve role questions, align the clauses with the TIA / TRA or support execution and ongoing transfer governance.
GUIDE STEPS
Use these sections as your working path through the DPO guide. If a processing fact is unknown, record it for clarification rather than guessing.
How to use this guide
02
Questions to resolve
03
Working steps
01
04
Determine exporter and importer roles
02
Select the correct SDAIA SCCs template
03
Complete the appendices against the actual transfer
04
Align SCCs with the TIA/TRA and commercial contract
05
Execute, register and monitor
Evidence to retain
05
Before you close
06
From guidance to operation
READY TO OPERATIONALISE IT?
Need to turn the guidance into an operating DPO Office control?
DPO Arabia can apply the Guide to your organisation’s actual processing, decisions and evidence, then implement and operate the resulting control through the appropriate DPO Office service.