PDPL and an AI agent at a Saudi car dealer: who is responsible for what.

Who is the controller, who is the processor

The dealer or importer decides why and how customer data is used, so it is the controller. The AI vendor processes the data on the dealer's instructions, so it is a processor. The controller stays responsible for checking that its processor complies.

The PDPL also reaches processing outside the Kingdom: it covers personal data of individuals residing in Saudi Arabia processed by any entity outside it. A processor that acts outside the controller's instructions is treated as a controller and held directly accountable.

Legal basis and consent

• 01Consent is the main legal basis. It must be freely given, for clear and specific purposes, separately for each purpose, and documented. It can be withdrawn.
• 02Explicit consent is needed for sensitive data, credit data and decisions based entirely on automated processing.
• 03Legitimate interest is available under conditions: the controller runs a legitimate-interest assessment, the customer's rights must not be overridden, and it cannot be used for sensitive data.
• 04Direct marketing needs consent and an easy way to opt out at any time.
• 05For a dealer this usually means: answering a customer who wrote first is one purpose; follow-up messages and marketing are others, each with its own basis recorded.

The contract with the AI vendor

• 01A written agreement with each processor, with the content the Implementing Regulations require.
• 02The processor tells the controller of a breach without undue delay.
• 03Subprocessors need the controller's prior approval, and the processor names them.
• 04The processor confirms it is not subject to other laws abroad that would stop it complying with the PDPL.

Transfers outside the Kingdom

Article 29 of the PDPL allows a transfer abroad for permitted purposes, if it does not harm national security or the Kingdom's vital interests, the recipient offers an adequate level of protection, and only the minimum data needed is sent. The Transfer Regulations (issued by SDAIA, updated in 2024) set out how.

Where a country has no adequacy finding, the controller can rely on appropriate safeguards: SDAIA's standard contractual clauses (four modules, including controller-to-processor), binding common rules for transfers inside a group, or a certificate of accreditation held by the recipient. Before relying on a safeguard, a Saudi controller carries out a transfer risk assessment covering the purpose, the nature of the transfer, the safeguards, the recipient's protection level and data minimisation; SDAIA published a guideline for it in February 2025. As of King & Spalding's November 2025 review, SDAIA had not published a list of adequate countries.

Some sectors add their own rules: banks need approval from the Saudi Central Bank, and telecoms and government data carry further limits.

Rights, breaches and records

• 01Data subjects can be informed of the legal basis and purpose, access their data, obtain it in a readable and clear format, ask for correction, completion or updating, and ask for destruction when it is no longer needed.
• 02Requests are answered within 30 days, extendable by another 30 where a request needs unusual effort or many arrive at once.
• 03Breaches that may cause harm are reported to SDAIA within 72 hours through the National Data Governance Platform, and to affected customers without undue delay.
• 04Controllers keep a record of processing for the life of the processing and five years after, and most private controllers register on the National Data Governance Platform.
• 05Fines for most breaches reach SAR 5 million and can be doubled for repeat offences.

What Salesteq does, exactly

The transfer decision is yours, and we give you the papers for it

Because Salesteq stores data in Finland, a Saudi dealer using it transfers personal data outside the Kingdom. Under the PDPL that is the controller's decision: which purpose, which safeguard, and the risk assessment behind it. We do not decide it for you and we do not tell you it is already solved.

What we provide: where every piece of data is stored and processed, the subprocessor list, the security measures annex and our retention periods, so your data protection officer or counsel can complete the assessment and choose the safeguard. If your group or regulator requires in-country hosting, raise it in the first call.

PDPL questions dealers ask

Bring your data protection officer.

We walk your DPO or counsel through the data flows, the subprocessor list and the measures annex, so the transfer assessment is done on facts.

Or write to [email protected]