Open the public control-matrix JSON or Markdown to inspect the current full-matrix summary counts, PDPL article-scoped sub-counts, and coverage posture. Request the signed reviewer bundle for control-level references.
This page gives reviewers the public compliance surface: the 177-control matrix, signed reviewer bundle, dated HA evidence, PDPL citation checks, and published constraints. Buyer-safe summaries are here; control-level mappings are in the reviewer bundle on request.
A machine-validated control-to-test traceability matrix spanning PDPL articles, audit findings, claim-boundary lines, and runtime controls. 177 controls tracked. Sanitized summary on this page; the signed reviewer bundle carries the full matrix with control-level mappings on request.
The live pilot includes breach-register management, subject-rights SLA tracking, consent withdrawal, subject export PDF, transfer-risk-assessment registers, and related admin/regulator/dashboard surfaces. The May 4 customer-route cutover baseline (current) continues to bootstrap its startup master key through Alibaba KMS; the May 16 GCP Dammam drill-standby exercise validates DNS/GKE/TLS routing only; the April 21 guarded rollout baseline remains a dated deployment proof.
PDPL enforcement is operational. As of January 2026, SDAIA confirmed 48 enforcement decisions covering unlawful processing, weak security controls, and unconsented marketing — administrative fines up to SAR 5 million, doubled for repeat violations, with intentional sensitive-data violations carrying up to two years' imprisonment. The control matrix, signed reviewer bundle, and machine-readable compliance records on this page are the implementation answer to that environment: not a future-risk story, but a here-now accountability surface that reviewers can verify independently.
Open the public control-matrix JSON or Markdown to inspect the current full-matrix summary counts, PDPL article-scoped sub-counts, and coverage posture. Request the signed reviewer bundle for control-level references.
The reviewer pack explains how to verify the manifest, signature, and included control-matrix artifacts independently.
The authoritative SDAIA-published PDPL English text is included in-repo, and a per-citation validator audits article references across the codebase.
The Eid hardening track documents full bilingual labels, live-detect fallback, signed policy refresh, seven-day browser audit chains, telemetry upload, and performance-budget evidence for Browser Guard.
Seven published artifacts buyers can open right now. Public matrix summary, reviewer brief, control matrix (JSON + Markdown), public trust report, reviewer pack, PDPL citation audit, and billing-integrity proof.
Two commands. Numbers and wording matter on a compliance page — validate them from the published JSON and the signed reviewer bundle, not from screenshots or forwarded notes.
The benchmark page publishes the current public detector benchmark snapshot, and the resources page links to the latest load-baseline and precision/recall JSON artifacts.
Day-to-day controls that sit alongside the documented PDPL evidence. None of these replaces the external attestation listed in published constraints, but together they describe how the running system is monitored, scanned, and gated against drift.
Every constraint we publish lives here, in one place, by design. Every other page on this site links to this list rather than maintaining its own — procurement, security, and legal reviewers all read the same wording.