Saudi PDPL and NCA Website Checklist: Forms, Cookies, CRM and Analytics

A PDPL compliance website review in Saudi Arabia should start with the places personal data enters and leaves your site: forms, cookies and tracking tags, the CRM behind your forms, and the analytics and vendors that receive copies. Fix consent and notices first, then data flows to processors and other countries, then security basics aligned with NCA guidance. This checklist explains each step in plain language; it is not legal advice.

The Saudi Personal Data Protection Law (PDPL) is overseen by the Saudi Data and AI Authority (SDAIA). It applies to organisations that process personal data of people in the Kingdom, and that includes the ordinary marketing website with a contact form, a newsletter sign up and a few tracking pixels. Most sites were built before anyone thought about these requirements, so data tends to leak into places the business has forgotten. The work below helps you find those places and close them in a sensible order.

Why websites are the first place to look

Your website is often the largest single collector of personal data in a business. Names, phone numbers, emails, job titles, CVs, appointment details and sometimes health or financial information flow in every day. Each form submission may travel to an inbox, a CRM, a spreadsheet, a marketing platform and an analytics tool. Every copy creates a duty to protect it.

Common gaps on Saudi websites

• Forms that collect more fields than the business actually uses.
• No clear notice at the point of collection explaining why data is needed.
• Marketing pixels that fire before any choice is offered to the visitor.
• Privacy policies copied from another country that do not mention the PDPL.
• Form entries stored in the CMS database indefinitely with no deletion routine.
• Agencies, plugins and chat widgets that receive data with no written agreement.

None of these is unusual, and none is hard to fix once you know it exists. The difficulty is visibility, which is why a structured review helps.

Step one: map the data your site collects

Before you change anything, build a simple data map. List every form, widget and script on the site and write down what personal data it touches, where that data goes, who can access it and how long it stays there.

This map becomes the backbone of your privacy notice, your vendor review and your retention rules. Keep it in a shared document and update it whenever the site changes.

Step two: fix forms and consent

Forms are where most personal data enters, so they are where a PDPL compliance website project usually delivers the quickest improvement.

Collect less

Remove any field the business does not use. If sales never calls the landline number, stop asking for it. If a careers form asks for date of birth or nationality, check whether HR actually needs that at application stage. Data you never collect cannot be lost.

Explain at the point of collection

Place a short notice next to the submit button that says what the data is for and links to the full privacy notice. Write it in Arabic and English, matching the language of the page.

Separate marketing consent

Do not bundle marketing permission into an enquiry form. If you want to send newsletters or promotional WhatsApp messages, use a separate, unticked checkbox, and store the date, time, page and wording shown. That record is what proves consent later.

Handle sensitive data with extra care

Clinics, schools, recruiters and financial firms often collect sensitive data through web forms. Health details, for example, deserve tighter access, stronger security and a hard look at whether the website is the right place to collect them at all. A secure patient portal or a call back request may be safer than a long open text field. Confirm with counsel which categories the law treats as sensitive in your case.

Step three: rewrite the privacy notice for Saudi Arabia

A website privacy policy Saudi Arabia visitors can understand should be written for your actual data flows, not copied from a European or American template. Use the data map from step one.

What the notice should cover

• Who you are and how to contact you about personal data.
• What data you collect, on which pages and for what purpose.
• The legal basis you rely on, such as consent or performing a contract.
• Who you share data with, including categories of vendors.
• Whether data is transferred outside the Kingdom.
• How long you keep each type of data.
• How people can access, correct or request deletion of their data.
• When the notice was last updated.

Publish Arabic and English versions with equal status and link to them from every form and the site footer. SDAIA publishes guidance on the law and its implementing regulations at sdaia.gov.sa; your legal adviser should check the final wording against the current rules.

Step four: cookies and tracking

Cookie consent Saudi Arabia requirements are best approached by asking a simple question: what loads on the page before the visitor makes any choice? On many sites the answer is a long list of analytics, advertising and heatmap scripts.

A practical approach

1. Audit every script and cookie using your browser tools or a tag manager preview.
2. Group them into strictly necessary, analytics, marketing and functional categories.
3. Load only strictly necessary items by default.
4. Show a clear banner in Arabic and English that offers accept and reject options with equal prominence.
5. Connect the banner to your tag manager so non essential tags wait for consent.
6. Record each choice and let visitors change it later from a footer link.

Whether consent is strictly required for each category under the PDPL is a question for your counsel. Building the site so it can respect a choice is good practice either way, and it puts you in a strong position if rules or guidance tighten.

Step five: CRM, analytics and retention

The website is only the front door. Data from forms usually ends up in a CRM, and that is where it lives longest.

CRM hygiene

• Limit CRM access by role so only the people who need records can see them.
• Turn on audit logs where the CRM supports them.
• Store the consent record alongside each contact.
• Set a retention period for unconverted leads and delete or anonymise them on schedule.
• Make sure exports to spreadsheets are controlled and not emailed around.

If your CRM was set up quickly and nobody owns its configuration, a CRM development and cleanup project can bring structure, access controls and retention rules into one place.

Analytics settings

Review analytics configuration for anything that captures personal data by accident, such as email addresses in page URLs after a form submission, or full IP addresses. Shorten data retention inside the analytics tool to what reporting really needs.

Retention rules

Write a short retention schedule: enquiries, job applications, newsletter subscribers, customer records and chat transcripts each get a period and an owner. Then automate deletion where possible. A website that stores every form entry in its database forever is a common and avoidable risk, especially on WordPress sites with form plugins.

Step six: vendors, processors and cross border transfers

Most websites rely on several outside services: hosting, email delivery, CRM, chat, analytics, advertising and the agency that maintains the site. Under the PDPL, the business remains responsible for how these processors handle personal data on its behalf.

Vendor checklist

• List every vendor that receives personal data from the site.
• Confirm a written data processing agreement exists with each one.
• Note where each vendor stores and processes data.
• Check what security measures and breach notification commitments they offer.
• Remove plugins, widgets and integrations nobody uses any more.

Transfers of personal data outside the Kingdom are subject to specific conditions under the law and its regulations. If your hosting, CRM or email platform keeps data abroad, record it in your data map and ask counsel whether the transfer meets the current requirements or whether a locally hosted option is more appropriate.

Step seven: security basics and NCA alignment

The National Cybersecurity Authority (NCA) publishes cybersecurity controls and frameworks, available at nca.gov.sa. Some apply mandatorily to government bodies and critical national infrastructure; private companies often use them as a benchmark. When people ask about NCA website requirements, the honest answer is that it depends on your sector and status, so confirm which controls apply to you. For most business websites, the basics below are a sound start.

• HTTPS everywhere, with modern TLS settings and HSTS.
• Multi factor authentication on the CMS, hosting panel, CRM and domain registrar.
• Regular updates to the CMS, themes and plugins, with a tested rollback.
• Backups stored separately from the live server and restored in tests.
• A web application firewall and rate limiting on forms and log in pages.
• Security headers such as Content Security Policy where practical.
• Logging and monitoring, with someone responsible for reviewing alerts.
• A written incident response plan that covers how you would notify SDAIA and affected people if a breach occurred.

For a deeper look at hardening, see our guide to enterprise website security in Saudi Arabia.

The Saudi PDPL website checklist in one place

1. Build a data map of every form, widget, script and vendor.
2. Remove unnecessary form fields.
3. Add short bilingual notices next to every form.
4. Separate marketing consent and record it properly.
5. Publish a Saudi specific privacy notice in Arabic and English.
6. Audit cookies and block non essential tags until the visitor chooses.
7. Restrict CRM access and store consent records with contacts.
8. Set and automate retention periods.
9. Sign processing agreements with every vendor and record transfer locations.
10. Apply core security controls and benchmark against relevant NCA guidance.
11. Write an incident response plan and name an owner.
12. Review the whole list whenever the site changes, and at least once a year.

Saudi PDPL obligations, implementing regulations and guidance are still developing. Treat this list as a technical starting point and confirm every legal question with qualified counsel or with SDAIA directly.

How Codeeo helps Saudi businesses with PDPL compliance website work

Codeeo is a web, app, software, AI and marketing company. Our team of 80+ people across Dubai, Riyadh and Karachi has delivered 200+ projects across the UAE and the US, and we are rated 4.7 from 23 Google reviews. Clients in Riyadh can meet the team at our office; elsewhere in the Kingdom we work over video calls.

We handle the technical side of privacy and security work: mapping data flows, rebuilding forms, setting up consent aware tag management, cleaning up CRM access and retention, removing unused plugins and hardening hosting. We work alongside your legal adviser, who owns the legal interpretation. A website audit is a practical first step, and larger fixes often fold into a web development project.

To review your site's forms, cookies and data flows, contact Codeeo and tell us what your website collects today.