DPO and compliance
Map data flows, legal-operational handoffs, control ownership, and evidence gaps before a regulator or customer review.
Assessment
PDPL Controls & Evidence Readiness Assessment
If a PDPL notice arrived tomorrow, could your team produce the evidence within five days?
Ten business days. One Saudi entity, two priority workflows, four evidence domains. Documents and synthetic material only. You end with a risk-ranked findings register, a control map, a remediation plan, and an executive readout.
Use any AI model. Raw Saudi personal data stays in Saudi by default. PDPL controls built into the path.
Duration
10 business days
From accepted complete intake to executive readout.
Fee
SAR 35,000
Fixed. Two milestone payments. VAT if applicable.
Capacity
Two starts a month
Each start date is reserved by the first payment.
Material
Documents only
Synthetic or redacted material. No client-system access.
Fee and payment terms
Fixed fee: SAR 35,000 (VAT if applicable). SAR 17,500, non-refundable, reserves an agreed start date after the scope of work is signed. The remaining SAR 17,500 is due after factual validation and before the final report and executive readout are released. The 10-business-day clock starts when the first payment has cleared and the complete intake pack is accepted. Maximum two starts per month.
Who it is for
Teams preparing AI workflows for PDPL enforcement scrutiny.
Security and engineering
Test whether the documented controls match the AI request path and whether retained evidence supports each claim.
Executives and risk owners
Get a risk-ranked view of what needs remediation, who should own it, and what should happen first.
The 10 business days
A fixed path from intake to executive readout.
Days 1–2
Confirm scope, stakeholders, AI data flows, and the evidence index.
Days 3–7
Review technical and operational controls, map them to PDPL requirements, and rank gaps by risk.
Days 8–10
Validate findings, prioritize remediation, finalize the control map, and deliver the executive readout.
Deliverables
Four artifacts your team can act on.
- Risk-ranked findings register with evidence references and named control owners.
- Control map to PDPL requirements, with implemented, partial, missing, and evidence-gap states.
- Prioritized remediation plan ordered by risk, dependency, and practical sequence.
- Executive readout covering material exposure, immediate decisions, and the next evidence gates.
Inputs
Documents and safe review material only.
- One Saudi legal entity.
- Up to two priority personal-data or AI workflows.
- Four operational evidence domains: DPO accountability and ownership; 72-hour breach-reporting workflow; data-subject-request handling; and marketing consent and opt-out evidence.
- Maximum 12 supplied artifacts or 150 pages total.
- Two 60-minute stakeholder sessions.
- One consolidated clarification round.
- One factual-validation call.
- One executive readout.
- Documents plus synthetic or redacted material only.
- No client-system access and no production personal data.
Provide architecture and data-flow diagrams, policies, processing inventories, vendor and sub-processor lists, control descriptions, and existing evidence indexes.
Use synthetic or redacted material only. DataSitr does not access client systems and does not accept production personal data for this assessment.
Additional entities, workflows, or material are separately quoted. The 10-business-day clock starts once the booking payment has cleared and the complete intake pack is accepted.
Preview the deliverables
Read a synthetic sample before you book.
The samples describe a fictional organization. Reviewer packets answer the questions each role usually asks first.
Sample
Sample findings register
Risk-ranked findings with evidence references.
Sample
Sample executive readout
What leadership sees on day 10.
One-pager
Assessment scope & fee
Printable bilingual summary for internal approval.
Reviewer packet
Compliance reviewer packet
For the DPO, legal team, or compliance officer.
Reviewer packet
Security reviewer packet
For vendor security, CISO, and AppSec review.
Reviewer packet
Procurement reviewer packet
For the budget holder or procurement lead.
Before you book
What the ten days feel like from your side.
How much of our time does it take?
Two 60-minute stakeholder sessions, one consolidated clarification round, one factual-validation call, and the executive readout. Between those, your team gathers the documents listed under inputs. Most clients spend under a working day in total.
Do you need access to our systems?
No. Documents plus synthetic or redacted material only. No client-system access and no production personal data. That keeps the assessment itself from becoming a data-transfer event.
What if we are further behind than we thought?
That is the normal case, and it is what the remediation plan is for: it is ordered by risk, dependency, and practical sequence, so the first month of work is obvious. The findings register names an owner for each control, so nothing waits on a meeting.
Can we pay in one instalment, or after delivery?
The first milestone reserves your start date and is not refundable; the second is due after factual validation and before the final report is released. Paying both at once is fine. Paying after delivery is not, because the two-starts-a-month limit makes each reserved date real.
Who does the work?
The founder of DataSitr, who is the registered DPO and wrote the gateway the controls are drawn from. You deal with one person from the fit call to the readout.
Boundaries
A technical and operational assessment, with explicit limits.
The assessment is not legal advice, a compliance determination, an audit, or a certification.
Controls are mapped to PDPL requirements; the assessment does not declare an organization compliant.
SDAIA application status: applied 2026-04-03, denied 2026-06-14, remediation and resubmission track
Book
Book the PDPL Controls & Evidence Readiness Assessment.
SAR 35,000 · SAR 17,500 non-refundable to reserve the agreed start date · SAR 17,500 due before final-report release · 10 business days from accepted complete intake · VAT if applicable.
A 20-minute call to confirm fit, scope, and a start date. No documents or personal data are needed for the call.