DPA GUIDE

What a KSA Personal Data Protection Law (PDPL) Data Processing Agreement (DPA) Needs to Cover

A decision-focused overview of the processing instructions, safeguards, assistance, sub-processing and accountability terms that should be reflected in a Processor agreement.

Use the working sequence below to connect the decision to operating implications, retained evidence and the point where specialist DPO support may be required.

Prepared by DPO Arabia

Practical KSA PDPL guidance, not organisation-specific legal advice.

KSA PDPL GUIDE

Make the DPA reflect the real processor relationship, not just a standard contract form.

The Guide frames the processing scope, Processor obligations, sub-Processor controls, security, assistance, deletion and transfer terms that should be reflected in the agreement. The organisation-specific conclusion should be validated before implementation.

USE THIS WHEN

Use when drafting, reviewing or renegotiating a DPA under the KSA PDPL.

This becomes relevant before processor onboarding, when scope changes, when a contract is renewed or when existing terms no longer match the processing.

HAVE READY

Bring the processing scope, due diligence results, data locations and commercial contract.

Useful inputs include the processor questionnaire, security evidence, subprocessor list, transfer route, retention terms and proposed DPA available.

OUTCOME

Finish with an executed DPA that is complete, traceable and connected to processor governance.

A complete evidence set retains the agreed obligations, negotiation record, approvals, transfer dependencies, open actions and review trigger.

HOW TO USE THIS GUIDE

Use the Guide to frame the decisions before implementation.

This Guide highlights the decisions, evidence and operating interfaces that should be resolved before the requirement is treated as complete.

Use it to understand the issue, challenge the relevant facts and identify where organisation-specific legal, operational or technical input is needed.

GUIDE OUTCOME

An executed KSA PDPL DPA that reflects the real processor relationship and can be operated after signature.

The objective is a defensible decision and an operating control, not simply a completed template or document.

QUESTIONS TO RESOLVE

What should the DPO Office establish?

DPA DECISION CHECKPOINT

Is the relationship genuinely Controller to Processor for the relevant processing?

Does the DPA accurately describe the Personal Data, Data Subjects, purposes, processing operations and Controller instructions?

Are the Processor’s confidentiality, security, assistance, sub-processing, breach, Data Subject Request (DSR) and deletion obligations operationally clear?

Do the contractual terms reflect the actual hosting, remote access, sub-Processor and international-transfer arrangements?

Has the final DPA been executed, registered, connected to the Processor assessment and assigned appropriate review triggers?

WORKING STEPS

Use the sequence to identify the decisions that need to be resolved.

Confirm the Processor relationship

Confirm that the provider is acting as a Processor for the relevant activity before treating a DPA as the correct contractual instrument. The contractual label should follow the actual processing role, not the fact that the counterparty is simply a supplier.

What to validate in practice

Confirm whether the provider processes Personal Data on the Controller’s behalf and under documented instructions.
Check whether the provider determines any independent purpose or essential means that could create a separate Controller role for part of the service.
Identify the contracting entity, the entity that actually performs the processing, and any sub-processors involved.
Where the service contains mixed roles, define which processing operations are Controller-to-Processor and which require a different contractual treatment.

DPO Arabia service

WHAT NOT TO DO

Do not use a Processor DPA merely because the counterparty is called a supplier. Confirm the actual processing role before selecting the contractual instrument.

Define processing details

Build the DPA processing schedule from verified operational facts. The schedule should describe the processing the Processor will actually perform and remain consistent with the Processor assessment and relevant Record of Processing Activities (RoPA) activity.

What to validate in practice

Define the processing purpose, Personal Data categories, Data Subject categories, processing operations and duration.
Document the systems, integrations, hosting locations, access locations and Controller instructions that govern the service.
Align retention, return and deletion expectations with the relevant business and regulatory requirements.
Avoid generic schedule wording where the actual processing scope can reasonably be identified and documented.

DPO Arabia service

OPERATING TIP

Use the Processor assessment and RoPA as factual inputs to the DPA schedule. The contract should describe the real processing relationship, not a generic service description.

Set Processor obligations

Translate the Processor relationship into operational contractual obligations. The DPA should allocate responsibilities that can be acted on when a Data Subject request, breach, sub-Processor change, deletion instruction or compliance review occurs.

What to validate in practice

Require processing only on clear Controller instructions and appropriate confidentiality for authorised personnel.
Define security, breach-notification, Data Subject Rights assistance, compliance evidence and cooperation obligations.
Control sub-Processor engagement, including identification, sufficient guarantees, prior acceptance and an opportunity for the Controller to object where applicable.
Define return, deletion, retention and termination requirements, together with the evidence needed to demonstrate completion.
Ensure contractual wording supports periodic monitoring of Processor compliance rather than treating signature as the end of oversight.

DPO Arabia service

DRAFTING PRINCIPLE

The DPA should allocate operational responsibilities, not merely repeat the PDPL. Each obligation should be clear enough to operate when an event or request occurs.

Align transfer terms

Separate the Processor agreement from the cross-border transfer mechanism. Where Personal Data is hosted, remotely accessed, supported, backed up or sub-processed outside the Kingdom, identify the applicable transfer requirements and align them with the DPA.

What to validate in practice

Confirm hosting, remote access, support, administration, backup and sub-Processor locations against the approved processing map.
Determine whether a TIA / TRA is required and document the applicable transfer condition and safeguard.
Where SDAIA SCCs are the appropriate safeguard, select the template that matches the Controller and Processor roles and ensure other contractual terms do not undermine it.
Confirm onward-transfer and sub-Processor arrangements remain consistent with both the DPA and the transfer safeguards.

DPO Arabia service

KEY DISTINCTION

A normal DPA does not by itself satisfy the KSA PDPL cross-border transfer requirements. Assess the transfer separately and apply Transfer Impact Assessment (TIA) / Transfer Risk Assessment (TRA) and Saudi Data & AI Authority (SDAIA) Standard Contractual Clauses (SCCs) or another applicable safeguard where required.

Execute and register

Complete the contractual governance around the final agreement. Execution should connect the DPA to the approved Processor, the service it governs, the relevant registers, any transfer safeguards and the controls that must be reviewed during the relationship.

What to validate in practice

Confirm the final approved agreement is executed by the correct legal entities and record the effective date, owner, renewal and expiry details.
Update the Processor Register and DPA Register and link the agreement to the relevant service, RoPA activity and Processor assessment.
Record outstanding contractual, security or transfer conditions with accountable owners and completion evidence.
Define reassessment triggers for material service changes, new sub-processors, new locations, renewal, termination or significant compliance concerns.
Ensure termination includes operational return or deletion requirements and evidence of completion.

DPO Arabia service

OPERATING TIP

DPA executed does not automatically mean Processor onboarding is complete. Any unresolved screening, security, SCCs or remediation condition should remain tracked until it is closed.

EVIDENCE TO RETAIN

Know what evidence should remain after the work is complete.

Retain the executed DPA, processing schedule, negotiation record, approvals, due diligence references, subprocessor terms, transfer dependencies, open actions and review history.

RETAINED EVIDENCE SET

Keep the signed DPA aligned to the actual Processor role and processing instructions.

Retain negotiation decisions, deviations and transfer-related contractual evidence.

Controller / Processor role determination

Approved Processor screening assessment

Verified processing scope and purpose

Processing schedule

Controller instructions

Final negotiated DPA

Privacy and security assurance evidence

Sub-Processor terms and inventory

Hosting and access-location evidence

Transfer assessment, where applicable

TIA / TRA, where applicable

SDAIA SCCs or other transfer safeguard, where applicable

Internal / legal approval evidence

Executed agreement

Processor Register entry

DPA Register entry

Outstanding conditions and owners

Renewal, review and termination / deletion controls

BEFORE YOU CLOSE THE WORKFLOW

Validate the operating position, not only the document.

Before closing the DPA review, confirm that the agreement matches the real processing, required processor obligations are covered, transfer dependencies are resolved and any negotiated exceptions or follow-up actions are documented.

Use the checks below to test whether the signed DPA can actually govern the processor relationship and be traced back to the underlying due diligence and processing scope.

The Processor role and relevant legal entities are confirmed for the processing governed by the DPA. The processing schedule reflects the actual Personal Data, purposes, operations, instructions, locations and duration. Processor obligations, sub-processing controls, breach support, DSR assistance, security and deletion requirements are operationally clear. International-transfer requirements, including TIA / TRA and SDAIA SCCs where applicable, have been resolved or formally tracked. The executed DPA is connected to the Processor assessment, Processor Register, DPA Register and defined reassessment triggers. Any outstanding contractual, security or onboarding conditions have accountable owners and closure evidence.

FROM GUIDANCE TO OPERATION

Connect the decision to the wider DPO Office.

A DPA becomes operational when the signed terms stay connected to the processor register, due diligence, subprocessor changes, transfers, incidents, deletion and periodic review. Use this handoff to keep the contract active as a control.

Apply the DPO guide

Use the guide to define the processing schedule, test the required clauses, reconcile the DPA with due diligence and document negotiation or exception decisions.

Connect the controls

Connect the executed DPA to the Processor assessment, RoPA, Processor Register, DPA Register, sub-Processor records, TIA / TRA, SCCs and termination controls so the agreement remains connected to the processing it governs.

SPECIALIST SUPPORT

Get specialist support

Use DPO Arabia to draft or review DPAs, identify KSA PDPL contractual gaps, negotiate processor terms or connect the agreement to wider processor and transfer governance.

GUIDE STEPS

Use these sections as your working path through the DPO guide. If a processing fact is unknown, record it for clarification rather than guessing.

How to use this guide

Questions to resolve

Working steps

Confirm the Processor relationship

Define processing details

Set Processor obligations

From guidance to operation

READY TO OPERATIONALISE IT?

Need to turn the guidance into an operating DPO Office control?

DPO Arabia can apply the Guide to your organisation’s actual processing, decisions and evidence, then implement and operate the resulting control through the appropriate DPO Office service.