Essential measures to Kickstart Compliance

PDPL law aims to protect the processing of personal data for local and foreign individuals living in Saudi Arabia. Even data processing organizations operating outside Saudi are obliged to comply if they process data for subjects living in Saudi Arabia. Processing data securely requires organizations to implement necessary organizational, administrative, and technical measures upon collecting, handling, storing, and retaining personal data to preserve confidentiality and privacy. More importantly, protect the rights of data owners upon their collected data according to the law requirements.

If your organization is processing personal data under the scope of the Personal Data Protection Law of Saudi Arabia (PDPL), you may be looking for quick guidance on organizing plans and prioritizing actions. Security is at the heart of data protection practices; here is a quick guide on what cybersecurity practices you should consider for your compliance journey.

Governance, Risk and Compliance (GRC)

Compliance should become part of your organization’s security program. Your organization’s security strategy should include plans, a roadmap, and budgeting estimates of what projects should be considered to comply with the law requirements. Based on your organization’s business size, you should appoint an officer in charge of compliance efforts.

New processes should be created to define a privacy policy that states the rights of data subjects upon collecting, processing, and preserving their personal information. Administrative procedures should be amended to facilitate understanding and performing necessary practices for processing personal data. These processes should be followed by the organization staff, who is responsible for handling personal data in terms of the law. For instance, what should be notified to subjects? How to verify the data collected is correct and complete? How long should the data be collected, and when or how the data should be destroyed?

Infrastructure and Applications Security

While organizational and administrative processes are necessary to define the direction and provide guidance on complying with PDPL law requirements, technical security measures are crucial to enforce access controls required to assure personal data protection. Your organization should regularly assess and evaluate the security posture of the infrastructure components and services utilized to collect, process, and store data. Security vulnerabilities and insecure configuration will likely lead to data leakage, loss, or manipulation, putting your organization at risk of a compliance breach.

Suppose your organization collects or processes data using third-party services. E.g., in that case, cloud-based services ensure these service providers have taken the necessary measures to protect data according to PDPL requirements. You should check with your providers when was the last time their services went through a security audit and what is the current posture. Your organization might need to perform vulnerability assessment and penetration testing for technical infrastructure used to process personal data.

Security Monitoring and Incident Response

PDPL law requires organizations to monitor, respond to, and notify authorities when data breach incidents occur. Organizations should implement and deploy proper security monitoring technologies to continuously monitor their processes and infrastructure services to detect and respond to security incidents affecting collected and processed data.

As healthcare providers and financial credit information data processors make sure you implement robust and granular access control solutions that enforce a need-to-know approach for controlling access to protected data. Access audit logs should be continuously monitored to ensure only authorized individuals have access to data and facilitate monitoring when a data breach occurs.

For security incident response, your organization should define and document procedures and measures to follow when a data breach occurs. These procedures should include escalation criteria within the organization and contact points for notifying authorities when required.

Compliance and Security Awareness

Remember that compliance is a journey, and your organization should continuously monitor and track organizational, administrative, and technical measures taken to protect personal data and preserve data subjects’ rights in terms of the law.

It is essential to build continuous security and privacy awareness about security threats and risks and provide training on following defined processes to ensure your staff and sub-contractors handle data securely according to the law requirements based on their roles and responsibilities. For tracking compliance, you can perform gap analysis by running the self-assessment toolkit available with the raw materials to identify existing compliance gaps and what areas have been covered or should be improved.

More Information

Do you require guidance or support with your journey toward PDPL compliance? Contact us to learn more about Oivan Cybersecurity services.

Dr. Bilal Al Sabbagh
Head of Cybersecurity at Oivan