Blog
Insights and practical guidance from PDPL experts on Saudi Arabia's Personal Data Protection Law.
Latest
Masterclass #18
Knowing the text of the law has never been what separates a comfortable audit from a difficult one. That was the premise Basmah Alsubaie, CEO of Privacy Professionals and former CEO of National Data Governance at SDAIA, set at the top of this masterclass on audit, assurance, and regulatory engagement.
Pyxos · 12 August 2026 · 4 min read
Masterclass #17
The 72-hour clock does not start when the data protection officer finds out. It starts the moment anyone in the organization becomes aware of the incident.
Pyxos · 15 July 2026 · 4 min read
KSA PDPL
SDAIA has issued a new set of enforcement decisions under the PDPL. What these decisions signal about enforcement in the Kingdom, and what DPOs should do in response.
Pyxos · 30 June 2026 · 6 min read
Masterclass #16
Most privacy teams treat the controller-or-processor question as a box to tick once a contract is drafted. Muneeb Imran spent this session arguing the opposite: the label is a risk decision, and getting it wrong does not announce itself until the architecture cracks years later, usually during a breach or an audit, when it is most expensive to repair.
Pyxos · 25 June 2026 · 4 min read
Privacy Leadership Workshop · Part 5 of 5
Part 5 of 5 from the Privacy Leadership Workshop in Riyadh: prompt injection, least privilege for agents, accountability, and privacy as purpose in the age of agentic AI.
Pyxos · 25 June 2026 · 6 min read
Privacy Leadership Workshop · Part 4 of 5
Part 4 of 5 from the Privacy Leadership Workshop in Riyadh: SDAIA platforms, the five-day response window, interim notifications, and the defensible compliance position.
Pyxos · 25 June 2026 · 6 min read
Privacy Leadership Workshop · Part 3 of 5
Part 3 of 5 from the Privacy Leadership Workshop in Riyadh: Basmah Alsubaie moderates six rising Saudi privacy professionals on careers, skills, and mentorship in the PDPL era.
Pyxos · 25 June 2026 · 4 min read
Privacy Leadership Workshop · Part 2 of 5
Part 2 of 5 from the Privacy Leadership Workshop in Riyadh: Hamza Saghir, Muneeb Imran Shaikh, Richard Chudzynski, Husain Meleeh, and James Beriker on the reality of the DPO role under the PDPL.
Pyxos · 25 June 2026 · 6 min read
Privacy Leadership Workshop · Part 1 of 5
More than 100 privacy professionals joined Pyxos and the IAPP at the Riyadh Chamber of Commerce for the Privacy Leadership Workshop. Part 1 of 5: Basmah Alsubaie's keynote on privacy, trust, and the PDPL.
Pyxos · 25 June 2026 · 4 min read
Masterclass #15
Most security failures under the PDPL do not happen because an organization lacked controls. They happen because the controls lived in a policy nobody operationalized, or because they were calibrated to the wrong risk.
Pyxos · 11 June 2026 · 4 min read
Masterclass #14
A privacy notice is the one part of a compliance program the whole world can read, which is exactly why it is so often the first thing a regulator checks. That was the framing Richard Chudzynsky of Konexo (Eversheds Sutherland) and Joe Corina, Head of Data Privacy Operations at Teya, brought to this masterclass on privacy notice and transparency management.
Pyxos · 8 June 2026 · 4 min read
Masterclass #13
If a regulator asked tomorrow to prove your privacy program works, what would you show, not what would you say. That question ran through this masterclass on privacy metrics and dashboards, led by Tahir Latif of the IAPP, whose central argument was that metrics are not operational reporting but evidence, of accountability, control effectiveness, oversight, and defensibility.
Pyxos · 4 June 2026 · 4 min read
Masterclass #12
Policies do not protect personal data; the people handling it do. That was the premise of this masterclass on privacy culture, awareness, and training, led by Muneeb Imran, DPO at the Saudi Credit Bureau, and it reframes culture from an HR formality into an operational control.
Pyxos · 21 May 2026 · 4 min read
Masterclass #11
A Data Protection Officer appointed in name but stripped of authority is a compliance gap, not a safeguard. That distinction animated this masterclass on the DPO role, led by Skanda Reddy and Richard Chudzynsky of Konexo (Eversheds Sutherland), whose central argument was that the role is advisory and independent rather than administrative, and that compliance depends on equipping the person, not merely designating them.
Pyxos · 14 May 2026 · 4 min read
Masterclass #10
The wishful-thinking phase is over. That was the unambiguous message of this roundtable on how PDPL enforcement is actually unfolding, a conversation among Basmah Alsubaie, CEO of Privacy Professionals and former CEO of National Data Governance at SDAIA; Richard Chudzynsky of Konexo (Eversheds Sutherland); and Tahir Latif of the IAPP.
Pyxos · 13 May 2026 · 4 min read
Masterclass #9
Strong controls decay the moment the project that built them ends, unless something holds them in place. That something is governance, and it was the subject of this masterclass led by Muneeb Imran, DPO at the Saudi Credit Bureau, whose framing was that governance is what turns PDPL compliance from a set of documents into the way an organization actually operates.
Pyxos · 30 April 2026 · 4 min read
Masterclass #8
Every processing activity has to answer one question before any other: why are we allowed to do this at all. That was the foundation Muneeb Imran, DPO at the Saudi Credit Bureau, built this masterclass on.
Pyxos · 23 April 2026 · 4 min read
Masterclass #7
You do not have a privacy program without a record of what data you hold, which is why this masterclass treated the Record of Processing Activities as the backbone of everything else. Led by Richard Chudzynsky and Aben Pagar of Konexo (Eversheds Sutherland), the session made the case that an organization simply cannot manage, protect, or govern personal data it has never inventoried, and that the RoPA is the artifact a regulator asks for first.
Pyxos · 16 April 2026 · 4 min read
Masterclass #6
Under the PDPL, artificial intelligence is not a separate regulatory category. It is personal data processing with the volume turned up, and the obligations that already apply simply apply harder.
Pyxos · 9 April 2026 · 4 min read
Masterclass #5
Keeping data because it might be useful one day is not a legal purpose, and treating it as one is where retention programs quietly go wrong. That was the practical spine of this masterclass on data retention, minimization, and deletion, led by Anurag Sushant, a DPO consultant at Salam.
Pyxos · 2 April 2026 · 4 min read
Masterclass #4
Not every arrangement with a foreign vendor is a cross-border transfer, and assuming otherwise is one of the more common and costly errors in this area. That was one of the clarifying points Muneeb Imran, Data Protection Officer at the Saudi Credit Bureau, made in this masterclass on cross-border personal data transfers, a topic he described as one of the most legally complex and operationally sensitive in PDPL practice.
Pyxos · 16 March 2026 · 4 min read
Masterclass #3
In a market still new to data subject rights, the organizations that handle them well are the ones that prepared before the first request arrived. That was the practical heart of this masterclass on Data Subject Access Requests, led by Richard Chudzynsky of Konexo (Eversheds Sutherland) and Joe Corina, Head of Data Privacy Operations at Teya.
Pyxos · 9 March 2026 · 4 min read
Masterclass #2
A dataset that looks harmless on its own can become sensitive the moment it is combined with another. That idea sat at the centre of this masterclass on higher-risk processing and Data Protection Impact Assessments, led by Tahir Latif, IAPP Country Leader for the UAE, KSA and Qatar.
Pyxos · 5 March 2026 · 4 min read
Masterclass #1
Outsourcing a task does not outsource the accountability that comes with it. That was the premise Richard Chudzynsky and Skanda Reddy of Konexo, the consulting arm of Eversheds Sutherland, returned to throughout this opening masterclass of the year.
Pyxos · 26 February 2026 · 4 min read
Get the latest Masterclass recaps, regulatory updates, and practical guidance on compliance Saudi Arabia's PDPL