Saudi Personal Data Protection Law

A prompt sent to a hosted model is a disclosure of whatever personal data it carries, to a processor, usually outside the Kingdom. The law permits disclosure only in the situations Article 15 lists, and a transfer abroad only for the purposes Article 29 allows and limited to the minimum personal data needed. This pack is the first control most deployments under the PDPL need: the personal data the pattern tier can find is replaced before the request leaves, which is that minimum, and every request that carried any is recorded against the articles a transfer record and a processing record are built from.

It is a starting point. Copy it, read every rule, and change what your reading of the law disagrees with. The pack certifies nothing.

What it does

Four rules over the built-in pii detector, in the order they run.

Rule	Acts on	Action	Articles
sa-pdpl-national-id	a national id or iqama number the Luhn check confirmed or a context word supported	replaced by a numbered placeholder	11, 19, 29
sa-pdpl-contact-details	email addresses and phone numbers	replaced by a numbered placeholder	11, 29
sa-pdpl-financial-identifiers	IBANs and card numbers whose checksum held	replaced by a numbered placeholder	11, 29
sa-pdpl-personal-data-recorded	any personal data any detector reported	recorded, the request goes on	15, 29, 31

Article 29(2)(C) is the citation the redactions rest on: a transfer or disclosure outside the Kingdom is limited to the minimum personal data needed, and a replacement before the request leaves is that minimum. Article 11(3) limits what is collected and is the secondary citation. Card and account numbers are personal data by the law’s own definition in Article 1; they are not Credit Data, which the law defines as data about financing and the ability to repay, so Article 24 is not cited.

The placeholder operator numbers spans per type within one request, <SA_NATIONAL_ID_1>, <SA_NATIONAL_ID_2>, so the model can still tell two people apart and can refer back to either. Nothing crosses requests. Where a downstream system needs the original back, the fpe operator is reversible under a key you hold; see the configuration reference for fpe_key and decide who holds it before switching.

The national-id rule asks for corroboration and the contact-details rule does not. A ten-digit number starting with 1 or 2 is an id only if its checksum says so or the words around it do; an email address is never anything else, and a phone number is the numbering library’s verdict rather than a pattern’s. A finding the rules did not replace is still recorded by the last rule, so a bare number that was an id after all is in the trail.

What it does not cover

• Names. A person’s name has no pattern or checksum. Add an nlp detector with a pinned model and select it in the last rule’s requires; the pack’s annotate rule already records what it finds. Arabic names need a checkpoint measured on them first. See Measure a detector.
• Health data (Article 23) and Credit Data (Article 24). No built-in detector recognises a diagnosis, a medical record number or a financing record. A classify or llm detector can.
• Whether the transfer is cross-border. That is a fact about your provider list, not about the request. The pack records that personal data went to a provider; which providers are inside the Kingdom is your providers: block, declared as metadata: {residency: sa}. The NDMO classification pack holds a key’s classification level to that declaration.
• Consent, purpose and the privacy notice. A gateway sees a request, not the relationship it belongs to.
• Text in the model’s answer. Response inspection is opt-in per detector. The rules already apply to output segments; add apply_to: [output] to the detector to inspect them. See Redact PII from model output.

Before you rely on it

• The article numbers were checked against the English text SDAIA publishes, dated 23 April 2023. The titles are readings of those articles. The Implementing Regulations and the transfer regulation set the conditions Article 29 defers to, and the pack does not cite them clause by clause.
• The pii detector is named pii. A document that already has one under another name gets a second instance; rename one, or change the pack’s requires to yours.
• Run the suite, then measure the detector on your own text: pistra guardrails eval scores it against labelled cases at the offsets a rule would act on.

Controls this pack cites

Every identifier below is declared in pack.yaml and named by a rule, an attachment or a mapping. A rule that cites one carries it onto every audit record it decides.

Control	What it requires	Text
sa-pdpl:art-11	Collection is limited to the minimum personal data the stated purpose needs (Article 11(3)).	citation
sa-pdpl:art-15	Personal data is disclosed only in the situations the law lists (Article 15).	citation
sa-pdpl:art-19	The controller takes organisational, administrative and technical measures to protect personal data, including during its transfer (Article 19).	citation
sa-pdpl:art-29	Personal data is transferred or disclosed outside the Kingdom only for the purposes and under the conditions the law sets, and limited to the minimum needed (Article 29(1), 29(2)(C)).	citation
sa-pdpl:art-31	The controller keeps records of its processing activities, including whether personal data is transferred outside the Kingdom (Article 31).	citation

Rules it adds

Rule	Kind	Action	At	Controls
sa-pdpl-national-id	guardrail	redact	none	sa-pdpl:art-11, sa-pdpl:art-19, sa-pdpl:art-29
sa-pdpl-contact-details	guardrail	redact	none	sa-pdpl:art-11, sa-pdpl:art-29
sa-pdpl-financial-identifiers	guardrail	redact	none	sa-pdpl:art-11, sa-pdpl:art-29
sa-pdpl-personal-data-recorded	guardrail	annotate	none	sa-pdpl:art-15, sa-pdpl:art-29, sa-pdpl:art-31

Related: Control packs for what shipped and what a pack is not.