PROCESSOR / THIRD-PARTY SCREENING
Assess processors before Personal Data is placed in their hands.
We take the screening through to a documented onboarding or continuation decision before Personal Data is placed with the provider, including the contractual, transfer or remediation conditions that must be addressed.
REGULATORY BASIS
KSA PDPL Article 8 and Implementing Regulation Article 17
OPERATING FOCUS
Role, processing scope, guarantees, locations, sub-processors, foreign access, contractual gaps and monitoring
OUTCOME
A documented onboarding or continuation decision with required conditions, safeguards and reassessment triggers
TYPICAL TRIGGERS
Bring this DPO service into the workflow when these events occur.
Each trigger can create a new privacy decision, control requirement or evidence obligation that should be assessed and retained.
01
New Processor or service provider
02
New SaaS platform
03
Contract renewal
04
New sub-processor
05
Hosting or support-location change
05
Material processing change
WHY IT MATTERS
Make Processor onboarding an evidence-backed accountability decision.
We assess the provider’s processing role, Personal Data scope, locations, security, sub-Processors, contractual position, transfer exposure and compliance evidence before approval. The output is a documented decision with clear conditions, open actions and review triggers rather than a procurement approval that leaves privacy risk unresolved.
The onboarding decision should answer one practical question: can this Processor handle the intended Personal Data under conditions that meet the Controller’s KSA PDPL obligations?
WHAT DPO ARABIA DELIVERS
Turn Processor due diligence into a documented onboarding decision.
The service connects processing scope, role, evidence, locations, contractual requirements and ongoing monitoring so the Data Protection Officer (DPO) Office can make and defend the onboarding decision.
01
Processor intake & evidence review
Assess the service, processing purpose, Personal Data, systems, locations, access, retention, security controls, certifications and privacy evidence.
02
Role determination
Confirm whether the provider acts as Processor, independent Controller or in another role for the specific processing activity.
03
Location, access & sub-processor mapping
Identify hosting, remote support, administration, sub-processors and other parties that may receive or access Personal Data.
04
PDPL contractual gap assessment
Compare the proposed agreement and Data Processing Agreement (DPA) against required Processor terms, Controller instructions, breach obligations, sub-processing conditions and foreign-law considerations.
05
Risk & onboarding recommendation
Record gaps, required safeguards, remediation actions and whether onboarding should proceed, proceed with conditions or remain pending.
06
Periodic reassessment framework
Define which changes in service, processing, location, sub-processors or contractual terms require the Processor to be reassessed.
HOW WE WORK
Move from Processor intake to an evidence-backed onboarding decision.
The four-stage workflow keeps processing scope, role, guarantees, gaps and the final decision connected in one assessment trail.
01
Discover
Collect the service, processing purpose, Personal Data, locations, access, sub-processors, retention and supporting evidence.
02
Determine role & scope
Confirm the relationship and establish exactly what processing falls within the assessment.
03
Assess guarantees & gaps
Evaluate privacy, security, contractual, sub-processing, location and KSA PDPL-specific requirements.
04
Decide & monitor
Document onboarding conditions, approval status, required actions and future reassessment triggers.
EVIDENCE YOU RETAIN
Keep the Processor assessment, decision and conditions together.
The evidence set shows what was assessed, which role and processing scope were confirmed, what gaps were identified and the conditions supporting the onboarding or continuation decision.
KSA PDPL REGULATORY CONTEXT
Connect Processor due diligence to the Controller’s selection and monitoring duties.
We use the KSA PDPL Processor-selection, agreement, instruction, monitoring and sub-Processor requirements to determine what evidence the provider needs to supply and what conditions the Controller needs to impose before onboarding or continuation.
Saudi PDPL Article 8 – Controller Obligations for Processors
Requires Controllers to select Processors that provide the necessary guarantees, monitor their compliance and remain accountable for obligations toward Data Subjects and the Competent Authority.
PDPL Implementing Regulation Article 17 – Choosing the Processor
Sets detailed requirements for Processor guarantees, agreement content, Controller instructions, periodic compliance assessment, violations and sub-Processor engagement.
RELATED DPO GUIDE
Need a practical method for assessing a Processor before onboarding?
The related DPO Guide provides deeper working context when collecting due-diligence evidence, confirming the provider’s role, checking locations and sub-processors, and deciding what conditions must be resolved before Personal Data is placed with the Processor.
THIRD PARTIES, CONTRACTS & TRANSFERS
How to Assess a Processor before Onboarding
USE WHEN: screening a new or existing Processor and documenting the evidence, gaps and onboarding decision.
RELATED THIRD PARTIES, CONTRACTS & TRANSFERS SERVICES
Connect Processor screening into the wider third-party governance lifecycle.
Continue into the contractual and transfer services that become relevant when screening identifies Processor terms, foreign access or cross-border safeguard requirements.
01
PROCESSOR CONTRACT
Data Processing Agreement (DPA)
We establish the Processor obligations, Controller instructions and contractual safeguards governing the processing relationship.
02
TRANSFER RISK
Transfer Impact & Risk Assessment (TIA/TRA)
We assess the destination, access model, safeguards and residual risks of the proposed cross-border transfer.
03
TRANSFER SAFEGUARD
SDAIA Standard Contractual Clauses (SCCs)
We put the appropriate Saudi Data & AI Authority (SDAIA) contractual transfer safeguard in place where the transfer mechanism requires it.
NEXT STEP
Need Processor / Third-Party Screening as a focused service or part of your DPO Office?
Share the proposed provider, service, processing scope and any available questionnaire, contract or security evidence. We can assess the Processor as a focused engagement or connect the work into the wider third-party governance support you need.