Assess lawful processing, transparency, data rights, security and international-transfer rules. Cookie processing requires a purpose/basis assessment under PDPL.
Processing in the Kingdom and processing of residents’ personal data from abroad, subject to exceptions.
SDAIA · 2026-10-23Source officielle ↗Apply relevant NCA security controls and retain evidence where in scope. Other businesses are encouraged to use the controls; no universal SME audit mandate is claimed.
Government entities/affiliates and private entities owning, operating or hosting critical national infrastructure; assess current detailed applicability.
National Cybersecurity Authority · 2026-10-23Source officielle ↗Cloud controls extend ECC; assess provider/tenant responsibilities and current localization provisions.
Cloud service providers and cloud service tenants covered by NCA scope and applicable services.
National Cybersecurity Authority · 2026-10-23Source officielle ↗Le champ d’application réglementaire est évalué selon les activités de l’organisation. Cette liste ne constitue ni un avis juridique ni une déclaration d’autorité officielle d’audit.