The Saudi PDPL Privacy Leadership Workshop

Registration & Arrival

Welcome & Opening Remarks

Tahir Latif, IAPP Country Leader — KSA, Qatar & UAE

Opening Keynote · Regulatory Expectations for PDPL Compliance in Saudi Arabia

Keynote: Basmah Alsubaie

Cutting through high-level theory, this keynote focuses on what data protection actually looks like on the ground in Saudi Arabia — what regulators truly expect, which programmes withstand scrutiny, and where organisations fall short. It unpacks the difference between a programme that claims compliance and one that can prove it through accountability, documented evidence and enforcement readiness, while addressing DPO effectiveness, AI risk and cross-border transfers. The message: PDPL compliance is no longer a legal checkbox but a strategic governance capability — defensible, measurable and operationally ready for what comes next.

Panel 1 · What It Actually Means to Be a DPO in Saudi Arabia

Moderator: Hamza Saghir · Panel: Richard Chudzynski (Partner, Konexo — Eversheds Sutherland), Muneeb Imran Shaikh (Data Privacy Expert), Yasir Bin Dabl (Director of Cybersecurity & Data Privacy, BSF Capital)

Independence, competence, and the reality of the role. Moderated panel with 3–4 practitioners (in-house DPO, legal, consulting) plus facilitator, with a 10-minute audience exchange. Explores real DPO independence inside Saudi organisations, where the role should sit to be effective, whether Heads of Legal, CISOs, CIOs or Data Governance leads can also serve as DPO, how the role changes in higher-risk sectors, building influence across legal, IT, cybersecurity, HR and procurement, the first 90 days for a new DPO, and the evidence the regulator or leadership should be able to see.

Panel 2 · The Next Generation of Saudi Privacy Leaders

Moderator: Basmah Alsubaie · Panel: Fatmah Alqhtani (Senior DPO, Privacy Professionals), Nora Albati (Data Governance & Compliance Manager, Tamimi Markets), Reghab Aledayni (Data Privacy Expert), Nawaf Jamal (Data Privacy Officer, NEOM), Latifa AlAkeel (Saudi Certified DPO and Privacy Leader), Rahaf Alkhleef (Data Privacy Lead, Al Rajhi Takaful)

What future DPOs need to learn, challenge, and build. Moderated panel with 4–5 rising Saudi privacy professionals plus facilitator, with a 10-minute audience exchange. Covers what drew them into privacy amid rapid regulatory, digital and AI transformation, what the next generation must do differently as organisations move from formal PDPL compliance to evidence and operational maturity, the skills that will matter most for the future Saudi DPO, and where younger professionals need more support — mentoring, sector exposure, certification, leadership opportunities and clearer career pathways.

Break

Panel 3 · The Regulatory Reality — Enforcement, Evidence, and Operational Readiness

Moderator: Skanda Reddy · Panel: Hamza Saghir (Head of Privacy & AI Trust SME, KPMG Middle East), Ali Abbas (Senior Associate, Al Tamimi & Company), Mahmoud Shafik Yousef (Group General Counsel, Foodics), Yasir Bin Dabl (Director of Cybersecurity & Data Privacy, BSF Capital)

What Saudi organisations must be ready to prove under PDPL. Moderated panel with 3–4 practitioners (in-house DPO, legal expert, privacy operations / governance lead) plus facilitator, with a 10-minute audience exchange. Examines where early programmes break under pressure — out-of-date RoPAs, late DPIAs, inconsistent lawful-basis decisions, manual DSR workflows and evidence that cannot be retrieved in time — alongside processor and vendor governance at scale, the difference between documentation and regulator-ready evidence, where technology genuinely improves readiness, and how leadership should answer the question: 'Are we genuinely PDPL-ready?'

Panel 4 · When AI Starts Acting on Our Behalf

Moderator: Tahir Latif · Panel: Dr Shaista Hussain (Founder & CEO, SAIF CHECK), Julia Kung (Director, Coherence Architecture Institute), Dr Nisar Ahmad Zafar (CEO, Habtal), Raza Rizvi (Partner, Simmons & Simmons), Faysal A Ghauri (Managing Partner, FANUUN BCG)

Opportunity, accountability and control in the age of agentic AI. Moderated panel with 3–4 practitioners (privacy / AI governance lead, cybersecurity or technology leader, legal / risk expert) plus facilitator, with a 10-minute audience exchange. Explores when agentic AI stops being a productivity tool and becomes a delegated decision-maker, access-control and least-privilege at agent level, accountability when an agent acts outside intention, how to assess agents pre-deployment (DPIA, AI impact assessment, cybersecurity and model risk review), hidden risks such as prompt injection and shadow AI, meaningful human oversight, the strongest legitimate opportunities in privacy operations, and the evidence a regulator, board or internal audit should be able to see.

Closing

James Beriker. Co-Founder & CEO, Pyxos

Lunch · End of Programme