Stratgik — technology strategy and business systems engineering.
Delivery across the USA, UK, UAE and India.
Saudi PDPLFully enforceable since 14 September 2024
SDAIA is issuing enforcement decisions, and organisations get only days to respond once notified. We map your personal data, set up notices, consent, breach reporting and data subject rights, and document cross-border transfers, inside the systems you actually run.
What is at stake
Once notified, organisations have very short response windows, so procedural readiness matters as much as the controls themselves.
Violations of the PDPL and its regulations, doubled for repeat offences
Disclosing sensitive personal data with intent to harm: up to 2 years’ imprisonment
Committees can also issue warnings and order the penalty to be published
What the law asks, in plain words
A clear policy explaining the purpose, legal basis, recipients and retention of personal data, available before collection.
Process data only with a valid legal basis. Consent must be specific and can be withdrawn.
Notify SDAIA within 72 hours of becoming aware of a breach that may harm individuals, and inform affected people where required.
Rights to be informed, access, correct, destroy and obtain a copy of data. Respond within 30 days.
Maintain records of processing activities and make them available to SDAIA on request.
Transfers outside the Kingdom must follow the Transfer Regulation, with a risk assessment where required.
Appropriate security controls and impact assessments for high-risk processing.
Some controllers must register on the National Data Governance Platform and appoint a data protection officer.
Free self-check
Ten questions, two minutes. Nothing is sent anywhere unless you ask for help.
How we get you compliant
Discover
Website, apps, CRM, ERP, spreadsheets, messaging tools and vendors.
Decide
Each gap scored against enforcement exposure and effort, so the serious ones get fixed first.
Implement
Notices, consent, request workflows, access controls, retention and vendor terms.
Hand over
A live session for the staff who handle data and a practice run of breach reporting.
Pricing
For organisations with one website or product and up to five systems holding personal data. Larger scope is quoted in writing before you pay anything.
Know where you stand under the PDPL.
SAR6,500one-time
+ VAT
Report in 7 working days
Choose Readiness AuditRecommended
We implement the controls in your systems.
SAR19,500one-time
+ VAT
Typically 4 to 6 weeks
Choose Compliance SetupStay ready as SDAIA guidance and your systems change.
SAR2,450per month
+ VAT
Cancel any month
Choose PDPL CareA clear line: Stratgik is a technology firm, not a law firm. We implement and operate compliance in your systems. Where you need a legal opinion, we work alongside your lawyer.
Free readiness call
An engineer replies within one working day with a suggested approach and a fixed quote.
Yes. It applies to processing of personal data of individuals residing in the Kingdom, including by entities outside it.
Fines of up to SAR 5 million per violation, which can be doubled for repeat violations. Disclosing sensitive data with intent to harm can lead to imprisonment of up to two years and a fine of up to SAR 3 million.
Within 72 hours of becoming aware of it, where it may harm individuals’ data or rights.
Transfers are allowed only in the circumstances set out in the Transfer Regulation, and some require a risk assessment. Some sectors have stricter localisation rules.
No. Stratgik is a technology firm. We implement the controls and records in your systems and work with your legal counsel for legal opinions.
Yes, for organisations with up to five systems holding personal data. Larger scope is quoted in writing first. VAT is added where applicable.
A readiness audit takes 7 working days and gives you a ranked, costed plan.
The Stratgik model
Four stages, in order. Most businesses need them one at a time.
