Saudi Contractors AuthorityMunjaz11My actionsNotifications

DMD-2026-007

Personal Data Protection Law compliance

ApprovedRegulatory requirement
Electronic formPriority evaluation
Priority score
88

Score confirmed by the evaluation panel

Estimated cost
SAR 4.6M
Net present value
SAR 4.4M
Internal rate of return
⁦39.6%⁩
Payback period
⁦2.3⁩ years
Rank in the 2027 plan
#1

of ⁦9⁩ candidates

  1. Gate into «Submitted»DecisionGoDate2 June 2026DraftComplete
  2. Gate into «Initial review»DecisionGoDate30 June 2026SubmittedComplete
  3. Gate into «Feasibility»DecisionGoDate28 July 2026Initial reviewComplete
  4. Gate into «Evaluation»DecisionGoDate25 August 2026FeasibilityComplete
  5. Gate into «Committee review»DecisionGoDate22 September 2026EvaluationComplete
  6. Gate into «Approved»DecisionGoDate20 October 2026Committee reviewComplete
  7. Gate into «Prioritized»DecisionNot held yetApprovedCurrent stageCurrent stage
  8. Gate into «Converted to project»DecisionNot held yet8PrioritizedNot started
  9. 9Converted to projectNot started

The request as filed

What the requester wrote on the intake form

Problem
The Personal Data Protection Law is in force, and the gap assessment found 37 controls not in place, including the record of processing and privacy notices for member contractors.
Current state
No data protection officer is appointed, there is no record of processing, and 12 systems collect member contractors’ personal data unclassified.
Objective
Full compliance with the Personal Data Protection Law and its regulations before the regulator’s audit in Q3 2027.
Expected scope
A DPO, the record of processing, privacy notices in Muqawil, impact assessments for 12 systems, and breach-notification procedures.

Expected benefits

Compliance

All 37 compliance gaps closed

Savings

Avoids fines of up to SAR 5M per violation

Strategic link

The objectives it serves and how well it aligns

Strategic alignment · Excellent

Related lessons learned

From similar past projects — read them before evaluation

Data governance comes before the analytics platform

From Project Tracking Platform — National Phase

At the initiation gate the Project Steering Committee made NDMO classification of contractor and project data a condition.

Recommendation: Tie any analytics or AI request to the data-governance outputs and name the data owners before evaluation.

Open the lesson

Similar requests and projects

To avoid duplication before approval

Esc

Quick actions

Go to

Projects

↑↓to move↵to openEscto close