01Scope & fee
PDPL Controls & Evidence Readiness Assessment
A fixed-scope, 10-business-day technical and operational review of priority personal-data or AI data flows, mapped to PDPL requirements and grounded in supplied evidence.
One bounded review.
- One Saudi legal entity.
- Up to two priority personal-data or AI data flows.
- Four evidence domains: DPO accountability and ownership; 72-hour breach-reporting workflow; data-subject-request handling; and marketing consent and opt-out evidence.
- Maximum 12 supplied artifacts or 150 pages total.
- Two 60-minute stakeholder sessions.
- One consolidated clarification round.
- One factual-validation call.
- One executive readout.
Teams preparing AI workflows for regulator, customer, or procurement review.
Designed for DPO and compliance teams, security and engineering leaders, executives, and risk owners who need an evidence-based view of priority gaps before regulator, customer, or procurement review.
Four decision-ready artifacts.
- Risk-ranked findings register with evidence references and named control owners.
- Control map to PDPL requirements, with implemented, partial, missing, and evidence-gap states.
- Prioritized remediation plan ordered by risk, dependency, and practical sequence.
- Executive readout covering material exposure, immediate decisions, and the next evidence gates.
Fixed fee: SAR 35,000 (VAT if applicable). SAR 17,500, non-refundable, reserves an agreed start date after the scope of work is signed. The remaining SAR 17,500 is due after factual validation and before the final report and executive readout are released. The 10-business-day clock starts when the first payment has cleared and the complete intake pack is accepted. Maximum two starts per month.
Explicit limits on the service.
- The assessment is not legal advice, a compliance determination, an audit, or a certification.
- Controls are mapped to PDPL requirements; the assessment does not declare an organization compliant.
- Documents plus synthetic or redacted material only; no client-system access and no production personal data.
- Additional entities, data flows, sessions, or material are separately quoted.