Assess lawful processing, transparency, data rights, security and international-transfer rules. Cookie processing requires a purpose/basis assessment under PDPL.
Processing in the Kingdom and processing of residents’ personal data from abroad, subject to exceptions.
SDAIA · 2026-10-23Resmî kaynak ↗Apply relevant NCA security controls and retain evidence where in scope. Other businesses are encouraged to use the controls; no universal SME audit mandate is claimed.
Government entities/affiliates and private entities owning, operating or hosting critical national infrastructure; assess current detailed applicability.
National Cybersecurity Authority · 2026-10-23Resmî kaynak ↗Cloud controls extend ECC; assess provider/tenant responsibilities and current localization provisions.
Cloud service providers and cloud service tenants covered by NCA scope and applicable services.
National Cybersecurity Authority · 2026-10-23Resmî kaynak ↗Mevzuat kapsamı kurumun faaliyetlerine göre değerlendirilir. Bu liste hukuki görüş veya resmî denetim yetkisi beyanı değildir.