Vendor Risk
& DPAs

Under the PDPL the controller remains legally accountable for processing it outsources — you cannot contract away that responsibility. Processors have their own obligations too, but administrative fines of up to SAR 5 million per violation (doubled for repeat offences) are assessed against the party that failed its duties, and a controller that never assessed its vendor or imposed contractual safeguards has little to point to. Due diligence, a sound DPA, and ongoing monitoring are how you demonstrate you discharged your obligations.

With every vendor that processes personal data on your behalf — cloud hosting, payroll providers, marketing platforms, customer-support tooling, logistics partners handling delivery details. A supplier of goods or services that never touches personal data does not need one. The inventory stage exists precisely to draw that line with evidence rather than assumption.

Sending personal data to a foreign vendor is a cross-border transfer, and transfers out of the Kingdom require a lawful pathway under the Personal Data Transfer Regulations — mechanisms referenced include Saudi-form standard contractual clauses, Binding Common Rules, SDAIA’s adequacy decisions as they are published, and certification. EU-form SCCs do not substitute for the Saudi mechanisms. Confirm the currently available pathways against SDAIA’s official publications before relying on one.

At onboarding before any data flows, at every contract renewal, and whenever something material changes — a new sub-processor, a new category of data, a security incident, or a shift in where the vendor processes data. Between those triggers, a periodic cycle proportionate to each vendor’s risk tier keeps the register honest. A questionnaire answered once at signature and never again is the pattern that fails.

It happens, especially with large global platforms that only offer their own paper. The options are practical: negotiate the closest acceptable clauses and document the gap, add compensating controls on your side (encryption, minimisation, restricting what data the vendor sees), or — where the data is sensitive and the vendor immovable — plan a substitution or exit. A risk-ranked register turns this from a stand-off into a business decision with a recorded rationale.