Pyxos

    PDPL Masterclasses

    Live, expert-led training on the Saudi PDPL for DPOs, privacy professionals, and compliance leaders.

    Interactive live sessions on Zoom on PDPL compliance delivered by partners at international law firms, former regulators, and senior in-house DPOs working under the PDPL today.

    Masterclass attendee feedback

    4.4 attendee rating

    The entire discussion was enjoyable and informative, but I found the advice for Data Protection Officers particularly inspiring.

    I really enjoy these sessions and appreciate the valuable insights shared. Thank you for the time and effort you put into keeping the series engaging and informative. I look forward to future sessions!

    Please continue, the sessions have been great.

    Upcoming sessions

    Next Up
    Phil Mennie

    Phil Mennie

    Partner, Forensics & Integrity Services, EY MENA

    MASTERCLASS 20

    Direct Marketing, Adtech and Digital Tracking

    Session overview

    This session will examine the operating model behind PDPL marketing compliance: consent management platforms, web and app analytics, SMS and WhatsApp campaigns, third-party audiences and the agency and platform contracts behind them. It will cover where consent is captured and where it fails, how opt-outs reach every vendor, what evidence of consent will stand up to scrutiny, and how SDAIA's October 2026 draft amendments to the Implementing Regulation would tighten evidence-of-consent and withdrawal requirements.

    18 November 2026
    11:00 to 12:00 Riyadh time (GMT+3)
    Register
    Calum Liddle

    Calum Liddle

    Head of Privacy Operations, NEOM

    MASTERCLASS 21

    Health Data: PDPL with the Ministry of Health and Health-Sector Overlay

    Session overview

    This session will map the PDPL's additional obligations for health data against Ministry of Health requirements and the wider health-sector overlay. It will work through patient records, insurer data flows, telehealth, clinical research and wellness apps, and show how to build one set of controls covering notice, access restriction, security and secondary use that satisfies both regimes.

    25 November 202611:00 to 12:00 Riyadh time (GMT+3)
    Register
    Muneeb Imran

    Muneeb Imran

    Data Privacy & AI Governance Expert, DPO, and Co-Author 'Data Privacy: Practical Handbook for Governance & Operations'

    MASTERCLASS 22

    Financial Services: PDPL with SAMA, CMA and Credit Data

    Session overview

    This session will build a dual-regime view of compliance for banks, insurers, finance companies and fintechs. It will map PDPL obligations onto SAMA and CMA requirements, identify where one control can evidence both, and cover the PDPL's specific controls on credit data. It will also work through open banking and fintech data flows, outsourcing and offshore processing, and preparation for supervisory reviews.

    9 December 202611:00 to 12:00 Riyadh time (GMT+3)
    Register
    Tahir Latif

    Tahir Latif

    IAPP Country Leader, UAE, KSA & Qatar

    Basmah Alsubaie

    Basmah Alsubaie

    CEO, Privacy Professionals

    Richard Chudzynsky

    Richard Chudzynsky

    Partner, KONEXO/Eversheds Sutherland

    MASTERCLASS 24

    Regulatory Enforcement Roundtable III

    Session overview

    This third roundtable will reconvene the panel to assess what has changed since September: the latest enforcement decisions, how inquiries progress once an organisation is notified, and what regulators accept as proof that controls operate. It will also consider what SDAIA's October 2026 draft amendments to the Implementing Regulation signal about enforcement priorities for the year ahead.

    20 January 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Phil Mennie

    Phil Mennie

    Partner, Forensics & Integrity Services, EY MENA

    MASTERCLASS 25

    Employee Monitoring and Workplace Surveillance

    Session overview

    This session will examine workplace monitoring under the PDPL, from CCTV and data loss prevention tools to productivity analytics, biometric attendance and vehicle telematics. It will cover when large-scale systematic monitoring as a core activity requires a DPO, the DPIA requirement proposed in SDAIA's October 2026 draft amendments, proportionality testing, retention, lawful investigations and transparency with staff.

    27 January 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Richard Chudzynsky

    Richard Chudzynsky

    Partner, KONEXO/Eversheds Sutherland

    Skanda Reddy

    Skanda Reddy

    Senior Associate, KONEXO/Eversheds Sutherland

    Aben Pagar

    Aben Pagar

    Head of Digital Risk Consulting, KONEXO/Eversheds Sutherland

    MASTERCLASS 26

    Anonymisation, Pseudonymisation and Privacy-Enhancing Technologies

    Session overview

    This session will examine when data stops being personal data under the PDPL and how to reduce exposure by processing less identifiable data. It will cover the line between anonymisation and pseudonymisation, re-identification risk assessment, synthetic data and other privacy-enhancing technologies, and their use to narrow processing scope, shorten retention and limit cross-border transfer exposure.

    3 February 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Richard Chudzynsky

    Richard Chudzynsky

    Partner, KONEXO/Eversheds Sutherland

    Skanda Reddy

    Skanda Reddy

    Senior Associate, KONEXO/Eversheds Sutherland

    Aben Pagar

    Aben Pagar

    Head of Digital Risk Consulting, KONEXO/Eversheds Sutherland

    MASTERCLASS 27

    Generative AI, Agents and Enterprise LLM Deployment

    Session overview

    This session will address the PDPL questions that arise when generative AI moves into production: fine-tuning on personal data, retrieval over enterprise documents, agentic workflows and vendor data-use terms. It will cover how SDAIA's AI Ethics Principles and generative AI guidelines sit alongside the PDPL, and take participants from AI use-case inventory to DPIA to contract.

    24 March 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Richard Chudzynsky

    Richard Chudzynsky

    Partner, KONEXO/Eversheds Sutherland

    Skanda Reddy

    Skanda Reddy

    Senior Associate, KONEXO/Eversheds Sutherland

    Aben Pagar

    Aben Pagar

    Head of Digital Risk Consulting, KONEXO/Eversheds Sutherland

    MASTERCLASS 28

    Breach Tabletop: A Live Incident Run Against the 72-Hour Clock

    Session overview

    This session will run a simulated personal data breach live against the 72-hour clock that applies, under the current Implementing Regulation, where a breach may cause harm. An incident team will work through triage, the awareness timestamp, harm assessment, the SDAIA notification, the data subject decision and sector regulator overlays, with the audience voting at each decision point. It will also cover SDAIA's October 2026 draft amendments, which would make notification to SDAIA independent of the harm assessment.

    7 April 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Basmah Alsubaie

    Basmah Alsubaie

    CEO, Privacy Professionals

    MASTERCLASS 29

    PDPL Certification and Accreditation Bodies

    Session overview

    This session will explain SDAIA's 2026 framework for accreditation certificates, under which licensed third parties assess controllers and processors and certify PDPL compliance. It will cover who can issue certificates, what an assessment examines, what accreditation does and does not prove, when pursuing it makes commercial sense, and how to prepare.

    21 April 202711:00 to 12:00 Riyadh time (GMT+3)
    Register
    Tahir Latif

    Tahir Latif

    IAPP Country Leader, UAE, KSA & Qatar

    MASTERCLASS 30

    GCC Comparative Session: KSA, UAE, Qatar, Bahrain and Oman

    Session overview

    This session will compare the personal data protection laws of Saudi Arabia, the UAE, Qatar, Bahrain and Oman on lawful bases, cross-border transfers, breach notification, DPO requirements and regulatory approach. It will identify where one set of controls can satisfy every regime and where local requirements must be handled separately.

    5 May 202711:00 to 12:00 Riyadh time (GMT+3)
    Register

    Browse the full Masterclass Library

    19+ on-demand summaries and recordings on DSARs, DPIAs, RoPA, cross-border transfers, AI governance, vendor management, and SDAIA enforcement under the Saudi PDPL โ€” searchable and filterable by topic.

    Open the library