They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
You cannot protect — or evidence — data you have not mapped. TCSA’s discovery engagement builds the inventory, the flow maps, and the defensible RoPA that every other PDPL obligation stands on: breach response, data subject requests, transfers, and SDAIA scrutiny.
Accountability is a core PDPL principle: a controller must be able to produce its records of processing — not reconstruct them under deadline.
4discovery phases
72hbreach notice to SDAIA
30dDSR response window
KSA PDPL (SDAIA) · Implementing & Transfer Regulations · Last reviewed June 2026
Direct Answer
What discovery actually produces
A discovery exercise produces three linked artefacts: a personal data inventory (what you hold and where), visual data-flow maps (how it moves through teams, systems, and third parties), and a legal-basis register tied to each activity. Together they roll up into the record of processing activities (RoPA) the PDPL requires controllers to maintain — covering purposes, data categories, recipients, cross-border transfers, and retention — and to produce to SDAIA on request.
Everything downstream depends on it. The 72-hour breach notification to SDAIA assumes you know which systems hold what. The 30-day data subject request window assumes you can find one person’s data across all of them. With the PDPL fully enforced since 14 September 2024, administrative fines reach SAR 5 million per violation — doubled for repeat offences.
Key Takeaways
- The PDPL’s accountability principle makes a RoPA a controller obligation — and SDAIA can ask you to produce it.
- Discovery yields three linked artefacts — data inventory, visual flow maps, legal-basis register — that feed directly into the RoPA.
- Every downstream obligation (72-hour breach notice, 30-day DSR responses, transfer governance) depends on knowing where the data actually is.
- The output is built to stay current: refresh triggers and named owners are part of the deliverable, not an afterthought.
Legal specifics summarised here — RoPA scope, fine ceilings, notification windows — should be confirmed against SDAIA’s official publications before you rely on them.
The Self-Test
Five questions you should already be able to answer
If any of these makes you reach for “I’d have to check”, the processing landscape is not mapped — and neither the breach clock nor the DSR clock will pause while you map it mid-incident.
Which processing carries the greatest risk?
Sensitive categories, large volumes, profiling, public-facing products. Until every activity is inventoried, you are prioritising by instinct rather than evidence.
Where does data enter and exit?
Every collection point — forms, apps, recruitment, partner feeds — and every exit: vendors, group companies, regulators, and transfers out of the Kingdom.
How does it move once inside?
Across teams, systems, spreadsheets, and third parties. The undocumented copies and side-channels are exactly where breach response and DSR fulfilment fail.
Can you state purpose and basis per activity?
The PDPL expects each processing activity to have a stated purpose and a defensible legal basis. "It has always worked that way" is neither.
Could you demonstrate it to SDAIA?
Accountability under the PDPL means showing your records, not describing your intentions. A producible, current RoPA is the difference between the two.
How It Runs
Four phases, one living record
The same discipline Tranquility Cybersecurity brings to 1,000+ audits for clients in India, the US, the UK, Australia and the UAE, applied to discovery: structured, evidence-led, and built to hand over.
01
Stakeholder interviews
We sit with the people who actually own the data — marketing, HR, product, IT, finance, operations — and walk through what each function collects, why, where it sits, and who it is shared with. Undocumented and shadow processing surfaces here, by design.
02
Inventory & flow mapping
Findings become a structured inventory and visual data-flow maps across departments, systems, and vendors. Each flow is tagged with its purpose and legal basis — the exact fields that feed the RoPA: purposes, data categories, recipients, cross-border transfers, retention.
03
Validation against the PDPL
Every mapped activity is checked against the law and its Implementing Regulations: is the basis defensible, does a notice cover it, does the transfer have a lawful pathway, is retention defined? Mismatches are logged as flagged gaps for remediation — not buried in an appendix.
04
Keep-it-current cadence
Discovery is a snapshot. Your organisation is not. We define refresh triggers — a new system, vendor, product, or market — plus periodic review cycles and named owners, so the inventory and RoPA stay producible instead of decaying into shelfware.
Deliverables
What you walk away with
- Personal data inventory across systems, departments, and third parties
- Visual data-flow maps showing where data enters, moves, and leaves the organisation
- RoPA in SDAIA-ready form — purposes, data categories, recipients, cross-border transfers, and retention per activity
- Legal-basis register mapping every processing activity to its lawful basis
- Retention schedule inputs per data category, ready for policy work
- Gap log of activities flagged for remediation — missing bases, undocumented transfers, orphaned data
Scoping and fees are confirmed on a short call — pricing depends on entity count, system landscape, and whether physical-records coverage is in scope. Gulf engagements are quoted in SAR, AED, or USD.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Data Discovery & RoPA — FAQs
What buyers ask before mapping anything.
What is a RoPA — and does the PDPL require one?
A RoPA (records of processing activities) is the controller’s structured register of what personal data it processes and how: purposes, data categories, recipients, cross-border transfers, and retention periods. Yes — maintaining it is a controller obligation under the PDPL’s accountability principle, and SDAIA can require you to produce it. Confirm the current formal requirements against SDAIA’s official publications, as guidance continues to evolve.
How is data discovery different from a PDPL gap assessment?
Discovery establishes the facts: what processing exists, where data lives, and how it flows — producing the inventory, flow maps, and RoPA. A gap assessment judges those facts against the law’s requirements and risk-ranks the shortfalls. They pair naturally: discovery gives the assessment something real to test. If you have neither, discovery — or a combined engagement — is the right starting point.
How do you handle shadow IT and systems nobody told you about?
By design. Interviews run across business functions, not just IT, and answers are triangulated — when marketing describes an export that IT has never heard of, that is a finding, not a failure. Where available we also review SSO logs, expense records, and vendor lists to surface unsanctioned SaaS. Unknown systems are precisely what the exercise exists to find.
How often should the inventory and RoPA be refreshed?
On triggers and on a cycle. Trigger events — a new system, vendor, product, or market — should update the affected entries immediately, and a periodic full review catches the drift in between. We set that cadence and name the owners in phase four, because an out-of-date RoPA is hard to defend as a record of anything.
Does discovery cover paper and physical records?
Yes. The PDPL applies to manual records processed systematically, not just databases — so HR filing cabinets, signed customer forms, and archived contracts are inventoried alongside systems, with location, access, and retention noted for each.
Continue your PDPL research
- The PDPL hub — the Saudi and UAE laws, obligations, and penalties in one place.
- PDPL gap assessment — test the mapped reality against every provision and get a risk-ranked register.
- PDPL implementation — turn the inventory and gap log into notices, workflows, and operating controls.
- DPO as a Service — ongoing ownership of the RoPA, DSRs, and SDAIA obligations once the foundation exists.
Keep Exploring
Related Reading
Privacy
PDPL Compliance (KSA & UAE)
Saudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read moreGulf
PDPL Gap Assessment
Identify gaps against PDPL requirements before a formal audit.
Read moreGulf
PDPL Implementation
Phased roadmap for PDPL compliance across KSA and UAE operations.
Read moreGulf
What Is the PDPL?
Saudi and UAE Personal Data Protection Laws — scope, rights, penalties.
Read moreLocations
Middle East — UAE & Saudi Arabia
How we serve Gulf banks, vendors and enterprises, remote + on-site.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read more