00Compliance · Reviewer desk
This page gives reviewers the public compliance surface: the 181-control matrix, signed reviewer bundle, dated HA evidence, PDPL citation checks, and published constraints. Buyer-safe summaries are here; implementation paths stay out of public artifacts.
Public control matrix · validated 2026-06-02 · 181 controls, 161 with test references · live
Two commands. Run them yourself.
01Executive summary
A machine-validated control-to-test traceability matrix spanning PDPL articles, audit findings, claim-boundary lines, and runtime controls. 181 controls tracked. Sanitized summary on this page; public rows omit implementation, test, evidence, source-reference, and provenance paths.
The live pilot includes breach-register management, subject-rights SLA tracking, consent withdrawal, subject export PDF, transfer-risk-assessment registers, and related admin/regulator/dashboard surfaces. The May 4 customer-route cutover baseline (current) continues to bootstrap its startup master key through Alibaba KMS; the May 16 GCP Dammam drill-standby exercise validates DNS/GKE/TLS routing only; the April 21 guarded rollout baseline remains a dated deployment proof.
PDPL enforcement is operational. As of January 2026, SDAIA confirmed 48 enforcement decisions covering unlawful processing, weak security controls, and unconsented marketing — administrative fines up to SAR 5 million, doubled for repeat violations, with intentional sensitive-data violations carrying up to two years' imprisonment. The control matrix, signed reviewer bundle, and machine-readable compliance records on this page are the implementation answer to that environment: not a future-risk story, but a here-now accountability surface that reviewers can verify independently.
Open the public control-matrix JSON or Markdown to inspect the current full-matrix summary counts, PDPL article-scoped sub-counts, and coverage posture. Implementation paths stay out of public artifacts.
From the public control matrix, validated 2026-06-02. 25 PDPL control entries across 20 distinct articles; 5 controls carry an active coverage gap.
The reviewer pack explains how to verify the manifest, signature, and included control-matrix artifacts independently.
The authoritative SDAIA-published PDPL English text is included in-repo at docs/pdpl-text/, and a per-citation validator audits article references across the codebase.
The Eid hardening track documents full bilingual labels, live-detect fallback, signed policy refresh, seven-day browser audit chains, telemetry upload, and performance-budget evidence for Browser Guard.
02PDPL coverage + audit trail
Seven published artifacts buyers can open right now. Public matrix summary, reviewer brief, control matrix (JSON + Markdown), public trust report, reviewer pack, PDPL citation audit, and billing-integrity proof.
03How to verify
Two commands. Numbers and wording matter on a compliance page — validate them from the published JSON and the signed reviewer bundle, not from screenshots or forwarded notes.
The benchmark page publishes the current public detector benchmark snapshot, and the resources page links to the latest load-baseline and precision/recall JSON artifacts.
04Operational security controls
Day-to-day controls that sit alongside the documented PDPL evidence. None of these replaces the external attestation listed in published constraints, but together they describe how the running system is monitored, scanned, and gated against drift.
05Published constraints
Every constraint we publish lives here, in one place, by design. Every other page on this site links to this list rather than maintaining its own — procurement, security, and legal reviewers all read the same wording.