What does the checker show?
Saudi Arabia's Personal Data Protection Law has two questions that tracking and video fleets ask first. Do we need a data protection officer? Do we register as a controller? Each has its own triggers. This checker holds the triggers we found, asks you a few questions about your business, and shows whether your answers match.
- Data protection officer: the three triggers in the SDAIA rules, with the reason each one matches or not.
- Controller registration: the criteria in the SDAIA register rules.
- Rules on file: every row with its source and the date we checked it.
What rows are on file?
The first seven rows paraphrase the SDAIA Rules for Appointing a Personal Data Protection Officer. The next three paraphrase the SDAIA Rules Governing the National Register of Controllers Within the Kingdom. We read both in the official text on 3 Nov 2026. The last row, for context, comes from an SDAIA statement carried by the Saudi Press Agency.
| Rule | What it says, in our words | Source |
|---|---|---|
| Public entity | A controller that is a public entity providing services that involve processing personal data on a large scale. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| Regular and systematic monitoring | A controller whose core activities are based on processing operations that, by their nature, require regular and systematic monitoring of the people the data is about. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| Sensitive data as a core activity | A controller whose core activities are based on processing sensitive personal data. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| What regular and systematic mean | Monitoring is collecting personal data by tracking or other technologies. It is regular if it is continuous, at specific intervals or periodic. It is systematic if it runs through technological systems, or follows a method or a plan. The examples listed include location tracking and surveillance cameras. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| What core means | An activity is core if the controller cannot provide its products or services without processing personal data. Activities that support the main business do not count. The example given is an entity processing its own employees' data for HR. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| Large scale | Scale is assessed by the number of people, the volume of data, the type of data, the geographic scope and the categories of people. The text gives no number. | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| Duties around the officer | Review from time to time whether an appointment case applies (Art. 9). An officer may be appointed voluntarily (Art. 9). When you use a processor, you may check whether it has an officer and require one where the rules call for it (Art. 9). Appoint in writing and tell staff (Art. 6). Give the officer's contact details to SDAIA through the National Data Governance Platform (Art. 7). The officer may be one of your employees or an outside contractor (Art. 4). | SDAIA, Rules for Appointing a Personal Data Protection Officer (official text) |
| Register: sensitive data | Registration on the platform is required if a controller processes sensitive data. | SDAIA, Rules Governing the National Register of Controllers Within the Kingdom (official text) |
| Register: main activity | Registration is also required if the controller's main activity involves processing personal data. The rules also list public entities (Art. 2 (1)) and individuals who process data beyond personal or family use (Art. 2 (4)). The checker tests both cases from the type of organization you pick. | SDAIA, Rules Governing the National Register of Controllers Within the Kingdom (official text) |
| Register: public entity | Registration on the platform is required if the controller is a public entity (Art. 2 (1)). | SDAIA, Rules Governing the National Register of Controllers Within the Kingdom (official text) |
| Register: individuals | Registration is required for an individual who processes personal data for purposes beyond personal or family use (Art. 2 (4), Art. 1 (6)). Individuals register themselves and cannot appoint a representative (Art. 3 (3)). | SDAIA, Rules Governing the National Register of Controllers Within the Kingdom (official text) |
| Register: certificate and renewal | A registration certificate is issued once registration is complete. It is valid for up to five years, and the authority notifies the controller at least 30 days before it expires. The rules state no fee: check the platform. | SDAIA, Rules Governing the National Register of Controllers Within the Kingdom (official text) |
| Law dates (context) | SDAIA states that the law entered into force on 14 Sep 2023 (29/2/1445H), with a grace period of up to one year to adjust. This checker does not use the date. | Saudi Press Agency, SDAIA statement on the law entering into force |
The rows are paraphrases. They are not quotes and they are not a translation of the law. Open the official text before you rely on a row.
How is the output decided?
There are three outputs and none of them is a ruling. Likely and unlikely describe how your answers match the text. Ask counsel means the result depends on something the checker cannot decide.
What do you need to enter?
- Your role: controller, processor or not sure.
- What the data is to your business: your service, or support for another business.
- Whether you process sensitive personal data, and whether your service is built on it.
- How people are monitored, and whether it is regular and systematic.
- For a public entity: how many people, and the number you treat as large scale.
Worked examples
A transport company tracks its own 250 drivers' vehicles to run deliveries. It answers Controller, Private, and Support, with location tracking, regular and systematic. No sensitive data, processed in the Kingdom.
- Officer: the monitoring supports another business, so the monitoring trigger does not match. No other trigger matches. Output: unlikely.
- Register: only "processing in the Kingdom" matches, and it is not enough on its own. Output: unlikely.
Change Support to Service, as for a provider whose product is tracking for customers, and keep Controller. Both outputs change.
- Officer: core activity, tracking, regular and systematic, so the monitoring trigger matches. Output: likely.
- Register: main activity matches, in the Kingdom. Output: likely.
Now change the role to Processor. Both outputs become Ask counsel, because the rules are written for controllers and your role is a legal question.
What mistakes do fleets and providers make?
- Reading "unlikely" as "not required". It describes a match with the text we hold, on your answers.
- Answering Support when the product you sell is the monitoring.
- Assuming a processor never needs to ask. The role is a legal question.
- Treating the large-scale number as an official figure. It is a typical value.
- Relying on the register criteria without opening the platform. The platform asks for details this checker does not hold.
Assumptions and limits
The checker does not read the law. It compares your answers with rows written from the official SDAIA rules on the officer and on the register, last checked on 3 Nov 2026. The scope of the rules can change, and there may be other duties under the law that the checker does not cover. It does not say that you comply, and it does not decide what SDAIA or a court would decide. It is not legal advice. Verify against the current official text and ask a legal adviser.