MunjazStrategy & projectsMunjazPMO PLATFORMBoard of Grievances
DMD-2026-007
Personal Data Protection Law compliance
ApprovedRegulatory requirement
Priority score
88
Score confirmed by the evaluation panel
Estimated cost
SAR 4.6M
Net present value
SAR 4.4M
Internal rate of return
39.6%
Payback period
2.3 years
Rank in the 2027 plan
#1
of 9 candidates
Gate into «Submitted»DecisionGoDate2 June 2026DraftComplete
Gate into «Initial review»DecisionGoDate30 June 2026SubmittedComplete
Gate into «Feasibility»DecisionGoDate28 July 2026Initial reviewComplete
Gate into «Evaluation»DecisionGoDate25 August 2026FeasibilityComplete
Gate into «Committee review»DecisionGoDate22 September 2026EvaluationComplete
Gate into «Approved»DecisionGoDate20 October 2026Committee reviewComplete
Gate into «Prioritized»DecisionNot held yetNext gateApprovedCurrent phaseCurrent phase
Gate into «Converted to project»DecisionNot held yet8PrioritizedNot started
9Converted to projectNot started
The request as filed
What the requester wrote on the intake form
Problem
The Personal Data Protection Law is in force, and a gap assessment found 37 controls not in place — among them the record of processing and privacy notices for the parties to cases.
Current state
No data protection officer is appointed, there is no record of processing, and 12 systems collect litigants’ personal data unclassified.
Objective
Full compliance with the PDPL and its regulations before the SDAIA audit in Q3 2027.
Expected scope
A DPO, the record of processing, privacy notices in Mueen, impact assessments for 12 systems, and breach-notification procedures.
