Past Masterclass June 11, 2026
Saudi PDPL Data Security: Technical and Organizational Measures (TOMs)
Security controls do not satisfy Saudi PDPL obligations simply by existing on paper. They must be appropriate to the risk, implemented in practice, and capable of being evidenced, and organizations routinely discover during audits or after an incident that controls written into policy were never operationalized. This masterclass examines data security and technical and organizational measures (TOMs) as a continuous discipline rather than a one-time exercise, grounded in Article 19 of the PDPL and Article 23 of the Implementing Regulations and situated within Saudi Arabia's dual regulatory regime, where the NCA's controls apply alongside PDPL. It addresses how to calibrate measures to genuine risk rather than over-engineer what most organizations already have.
Presenters
Aben Pagar
Head of Digital Risk Consulting, KONEXO/Eversheds Sutherland
Skanda Reddy
Senior Associate, KONEXO/Eversheds Sutherland
Recording
We'll email you the link and passcode.Read the Blog Post
Key takeaways
- Technical and organizational measures (TOMs) do not satisfy Saudi Personal Data Protection Law (PDPL) obligations by existing on paper. They must be appropriate to the risk, implemented in practice, and capable of being evidenced, since organizations routinely discover during audits that controls documented in policy were never operationalized.
- The legal foundation sits in Article 19 of the PDPL and Article 23 of the Implementing Regulations, which require necessary organizational, administrative, and technical measures whenever personal data is processed.
- Security controls follow a continuous, risk-driven lifecycle rather than a one-time setup, and are re-tested as threats, systems, and standards change. A named owner is needed to keep them current.
- Controls degrade over time, so a measure judged adequate today may become insufficient tomorrow. A deprecated encryption or hashing algorithm is the clearest example.
- Controls are reassessed on defined internal and external triggers.
- Appropriate measures span the recognized control domains, selected to fit the organization's risk rather than adopted wholesale. Applying every control uniformly is both meaningless and overkill, since the risk of a furniture purchase differs entirely from a cloud analytics platform.
- Risk identification is the foundational and most consequential step. It warrants formal documentation, alignment with the enterprise-wide risk definition, and executive sign-off, because the organization's risk appetite shapes which controls it selects.
- Saudi Arabia imposes a dual regulatory obligation: the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls and sector-specific controls apply alongside PDPL data-protection requirements, with recognized best-practice standards as the alternative where NCA controls are not mandated.
- Recognized control benchmarks include ISO 27701, NIST SP 800-53, and the NCA's standards. ISO 27701 became a standalone standard in 2025, separated from ISO 27001.
- Sensitive categories carry enhanced requirements. Health and credit data attract additional controls under the PDPL and applicable sectoral rules.
- When disclosing personal data to a recipient such as a processor, the controller must assess that the recipient provides sufficient guarantees and a comparable level of security.
- A documented and tested breach notification policy and procedure is itself an organizational measure, making engagement with the Saudi Data and AI Authority (SDAIA) faster when an incident occurs.
- A defensible program is evidenced through maintained documentation an auditor can trace to live operations.
- Internal audit, as the third line of defense, is central to checking control effectiveness. It is most useful when treated as a partner that surfaces deficiencies, not as a policing function, with its findings feeding the monitor-and-improve step.
- TOMs are inherently cross-functional: legal handles the PDPL nuance, IT and cyber implement, and the privacy function brings the teams together. The recurring practical message is not to over-engineer what most organizations already have.
Frequently Asked Questions
Saudi PDPL requires controllers and processors to implement necessary organizational, administrative, and technical measures whenever personal data is processed, under Article 19 of the PDPL and Article 23 of the Implementing Regulations. The measures must be appropriate to the risk, implemented in practice, and evidenced, not merely documented in policy. They must also hold when data is disclosed to a processor, who must provide sufficient guarantees of a comparable level of security.
Saudi PDPL does not prescribe a fixed control set. Appropriate measures span the recognized control domains, access management among them, selected to fit the organization's processing risk rather than adopted wholesale. Recognized benchmarks such as ISO 27701, NIST SP 800-53, and the NCA's Essential Cybersecurity Controls help organizations define their own set.
Yes. Saudi Arabia imposes a dual obligation, with the National Cybersecurity Authority's Essential Cybersecurity Controls and sector-specific controls applying alongside PDPL data-protection requirements. Where NCA controls are not mandated for a given organization, recognized industry best-practice standards apply as the alternative. Financial institutions face additional SAMA requirements layered on top.
Controls must be risk-proportionate, calibrated to the sensitivity and volume of personal data and the nature of the processing, not applied uniformly across the organization. Calibration should be performed by professionals with sufficient expertise to reduce residual risk to an acceptable threshold, and documented through tools such as the Data Protection Impact Assessment (DPIA). Applying every available control regardless of risk is both impractical and overkill.
Access management is consistently the most common gap, typically over-broad access rights and weakly controlled privileged accounts. Remediation is grounded in least-privilege design and reinforced by continuous training and awareness, rather than tooling alone. Patch management and phishing susceptibility also rank among the most frequent weaknesses.
Sensitive personal data requires additional layers on top of baseline controls, calibrated to the heightened risk rather than applied as a fixed list. Recognized measures such as multi-factor authentication and data loss prevention tooling are commonly used to enforce stricter handling, for example by blocking a sensitive file from leaving the organization. Health and credit data attract enhanced control requirements under the PDPL and applicable sectoral rules.