They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
Most PDPL incidents start with a person, not a system — a support agent who didn’t recognise a data subject request, a marketer who reused a list, an engineer who shipped without a deletion path. TCSA delivers role-based training that makes the law operational for the teams who actually touch personal data.
Built for how your organisation really works: each function learns the obligations it can trigger, not a generic tour of the statute.
6role-based tracks
72hbreach notice to SDAIA
30 daysDSR response window
KSA PDPL (SDAIA) · Role-based curriculum · Last reviewed June 2026
Direct Answer
Why generic e-learning fails the PDPL
A single annual slide deck teaches everyone the same abstractions and no one their actual job. The PDPL lands differently per role: marketing must operate a consent standard that is specific, informed, and withdrawable. Support must spot a data subject request inside an ordinary complaint and start a 30-day clock. Security must recognise a personal-data breach fast enough to meet the 72-hour notification to SDAIA. Role-based training teaches each team the handful of obligations it can personally trigger — and produces the records that show a regulator or enterprise customer the organisation took its accountability seriously.
Key Takeaways
- Six role-based tracks: leadership, HR, marketing, engineering/product, customer support, and security/IT — each scoped to the obligations that team actually touches.
- The PDPL does not say "train your staff" in one clause — but the accountability principle and security safeguards duty make staff awareness a practical necessity, and training records standard compliance evidence.
- Five phases: baseline assessment, tailored curriculum, live delivery, reinforcement, and refresh as regulations and the business change.
- Output includes audit-ready evidence: attendance records, content versions, and assessment results an SDAIA enquiry or customer review can ask for.
Role-Based Curriculum
Six tracks, one law
Every track answers the same question for a different audience: which PDPL obligations can your team trigger, and what does doing it right look like on a normal working day? Legal specifics are kept current against SDAIA’s official publications.
Leadership & boards
The accountability principle, realistic penalty exposure — administrative fines up to SAR 5 million per violation, doubled on repeat — and the governance decisions only leadership can make: ownership, budget, and risk appetite.
HR teams
Employee and candidate data end to end: what can be collected at hiring, how long records may be kept, when consent is the wrong basis, and how to handle requests from current and former staff.
Marketing teams
The PDPL consent standard — specific, informed, withdrawable, and as easy to withdraw as it was to give — plus what that means for lists, campaigns, profiling, and the tools that quietly collect more than the form shows.
Engineering & product
Data minimisation as a design constraint, when a DPIA is triggered for new features, and building deletion paths that actually work — because a destruction right you cannot execute is a finding waiting to happen.
Customer support
Recognising a data subject request when it arrives mid-conversation, verifying identity before disclosing anything, and routing it fast — the 30-day response window starts whether or not the front line noticed.
Security & IT
Spotting a personal-data breach among ordinary incidents and escalating it immediately — the 72-hour notification clock to SDAIA leaves no room for a ticket that sits in a queue over the weekend.
How It Runs
Five phases, not a one-off webinar
Awareness decays. The programme is built as a loop — measure, teach, reinforce, refresh — so the knowledge is still there when the incident, the request, or the enquiry actually arrives.
01
Baseline assessment
We measure what your teams actually know and where the risky habits live — short assessments and interviews per function, so the curriculum targets real gaps instead of repeating what people already do well.
02
Curriculum design
Content is built around your data flows: your CRM, your hiring pipeline, your support desk. Scenarios use situations your people genuinely face, not abstract textbook examples about fictional companies.
03
Delivery
Live workshops and role-specific sessions rather than a single all-hands webinar — backed by concise reference materials each team can return to when the question comes up six weeks later.
04
Reinforcement
Scenario exercises, short assessments, and internal awareness campaigns keep the material alive between sessions — and produce the assessment results that show the training landed.
05
Refresh
Regulations evolve and so does your business. The curriculum is updated as SDAIA issues new guidance, as you launch new products or markets, and as the baseline shows where knowledge has decayed.
Evidence
Training records are compliance evidence
Under the accountability principle, a controller must be able to demonstrate compliance — and when an auditor, an enterprise customer, or an SDAIA enquiry asks how your staff know their obligations, “we ran a session once” is not an answer. The programme is designed to leave a paper trail that is. Confirm the evidential expectations that apply to you against SDAIA’s official publications.
- Attendance records per session — who was trained, when, and in which role-based track
- Content version history — what each cohort was actually taught, mapped to the obligations it covered
- Assessment results showing comprehension, not just completion
- Refresher schedule and completion tracking for new joiners and role changes
Tranquility Cybersecurity delivers compliance programmes across India, USA, UK, Australia and UAE. Scoping and fees are confirmed on a short call — pricing depends on headcount, the number of role-based tracks, and delivery mode. Gulf engagements are quoted in SAR, AED, or USD.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
PDPL Training & Awareness — FAQs
Straight answers before you commit to anything.
Does the PDPL explicitly require privacy training?
The law does not contain a standalone "train your staff" clause in so many words. But the accountability principle requires controllers to be able to demonstrate compliance, and the duty to implement organisational security safeguards is read in practice to include staff who know how to handle personal data. That is why training records — attendance, content, assessment results — are standard compliance evidence in any serious PDPL programme. As with all legal positions, confirm the current requirements against SDAIA’s official publications.
Which teams need PDPL training most urgently?
The teams that touch personal data daily and can trigger an obligation without realising it: customer support (a complaint email can be a data subject request with a 30-day clock), marketing (the consent standard is stricter than most teams assume), and security/IT (the 72-hour breach notification to SDAIA fails if the first responder does not recognise a personal-data breach). Leadership comes next — they own the accountability and the penalty exposure.
How often should PDPL training run?
A full role-based programme at the start, then refreshers at least annually — plus triggered updates when SDAIA issues new guidance, when you launch a new product or market, and whenever the baseline assessment shows knowledge decaying in a specific team. New joiners and people changing roles should be trained as part of onboarding, not at the next annual cycle.
What language and format is the training delivered in?
Sessions are delivered in English, with materials structured for Gulf teams — examples grounded in KSA and UAE operating realities rather than EU case law. Delivery is live by default (remote workshops or on-site sessions), because role-based discussion is where the behaviour change happens. Concise reference materials remain with each team afterwards.
How do we measure whether the training worked?
Three signals: assessment scores against the baseline (did comprehension actually move), behavioural indicators (are DSRs being recognised and routed faster, are DPIAs being raised by product teams unprompted), and audit readiness (can you produce attendance, content versions, and results on request). TCSA has run 1,000+ audits — the difference between a programme that trained people and one that merely scheduled training is visible in those records.
Continue your PDPL research
- The PDPL hub — the Saudi and UAE laws, obligations, and penalties in one place.
- PDPL implementation — the end-to-end programme that training plugs into.
- DPO as a Service — ongoing privacy operations, with awareness training on a regular cadence.
- Privacy by Design — where trained engineering teams put minimisation and DPIAs into practice.
Keep Exploring
Related Reading
Privacy
PDPL Compliance (KSA & UAE)
Saudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read moreGulf
PDPL Implementation
Phased roadmap for PDPL compliance across KSA and UAE operations.
Read moreService
Training
Framework and security-awareness training for client teams.
Read moreGulf
What Is the PDPL?
Saudi and UAE Personal Data Protection Laws — scope, rights, penalties.
Read moreLocations
Middle East — UAE & Saudi Arabia
How we serve Gulf banks, vendors and enterprises, remote + on-site.
Read moreGulf
SAMA CSF & BCM
The Saudi Central Bank's cyber and continuity frameworks, demystified.
Read more