Data Processing Agreement in Saudi Arabia: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract between a party that decides why and how personal data is used (the controller) and a party that processes that data on its behalf (the processor). It sets what the processor may do with the data, the security it must keep, how it handles breaches and sub-processors, and what happens to the data at the end. In Saudi Arabia, a DPA is the document that puts a vendor relationship on the right side of the Personal Data Protection Law. Any time a supplier handles personal data for you, such as a cloud provider, payroll firm or marketing agency, a DPA should sit alongside the main services contract. ## When you need a DPA in Saudi Arabia Use a DPA whenever a third party processes personal data on your instructions. Common cases: hosting and SaaS, customer support, analytics, HR and payroll, and outsourced IT. If two parties each decide independently why they use the data, that is a different (joint or independent controller) arrangement, not a controller-to-processor DPA. ## What Saudi law requires Saudi Arabia's Personal Data Protection Law (PDPL) was issued by Royal Decree No. M/19 of 2021, amended in 2023, with Implementing Regulations. It is enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA) and has been enforceable since 14 September 2024. Alongside it, general contract rules come from the Civil Transactions Law (Royal Decree No. M/191, in force from 16 December 2023). Key points the PDPL drives into a DPA: - Controller stays responsible. The controller must choose a processor that gives sufficient guarantees and must verify the processor's compliance with the law and regulations.

• Processing on instructions. The processor should act only on the controller's documented instructions and for the agreed purpose.
• Breach notice. Breaches must be notified without undue delay; the regulations set short timelines, so the DPA should require the processor to report incidents fast enough for the controller to meet them.
• Cross-border transfers. Transfers of personal data outside the Kingdom are restricted and allowed only on specific legal bases, so the DPA should state where data is stored and the basis for any transfer.
• Data subject rights and records. The processor must help the controller answer data subject requests and keep records of processing. ## Key clauses in a Saudi DPA ### Roles and scope Name the controller and processor, the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects. ### Processing on documented instructions The processor acts only on the controller's instructions and flags any instruction it believes breaches the law. ### Security measures Technical and organisational measures appropriate to the risk: access control, encryption, logging and staff confidentiality. ### Sub-processors Whether sub-processors are allowed, prior approval, and flow-down of the same obligations. ### Breach notification The processor reports incidents to the controller quickly, with enough detail for the controller to meet its own SDAIA and notification duties. ### Data location and transfers Where data is stored, and the lawful basis for any transfer outside Saudi Arabia. ### Data subject rights and audits The processor assists with data subject requests and allows the controller to verify compliance. ### Return or deletion On termination, the processor returns or deletes personal data and copies, as the controller chooses. ## A simple Saudi DPA template outline 1. Parties (controller and processor) and effective date

2. Definitions (aligned to the PDPL)
3. Subject matter, duration, nature and purpose
4. Types of personal data and categories of data subjects
5. Processing on documented instructions
6. Confidentiality of personnel
7. Security measures
8. Sub-processors and flow-down
9. Data subject rights assistance
10. Breach notification
11. Data location and cross-border transfers
12. Audits and compliance verification
13. Return or deletion on termination
14. Liability and governing law (Saudi Arabia)
15. Signature blocks ## How to draft and review one well Match the DPA to the actual data flow: list what data the processor really touches, where it sits and who else (sub-processors) sees it. Keep the breach-notice window tight enough that you can still meet your own SDAIA deadlines. Review the DPA whenever the service or sub-processors change, not just at signing. ## Draft, review and track a DPA in one workspace A DPA usually lives next to a services or SaaS contract, and the two can drift apart as vendors and sub-processors change. Adira is an AI legal operating system that keeps drafting, clause-level review and version history in one place, so the DPA stays linked to the main contract and its review dates. Adira is India-first today; deeper Saudi Arabia and PDPL coverage is on its roadmap, so treat Saudi-specific drafting as a starting point to confirm with local counsel. See the approach at Adira. This article is general information, not legal advice. Confirm current PDPL requirements and SDAIA guidance with a qualified local lawyer before you sign.