Why Your ERP Is the Center of PDPL Compliance
When executives hear "personal data protection," they tend to think of the website, sign-up forms and marketing lists. In most Saudi companies, though, the largest store of personal data is the ERP system. It holds employee files with national ID, iqama and passport numbers, salaries and bank accounts, sick leave records, attendance fingerprints, individual customers' details, and the names and mobile numbers of supplier contacts.
The Personal Data Protection Law (PDPL) came into force in September 2023, with enforcement starting after a one-year grace period in September 2024. It is overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA). This guide is not legal advice. It translates the law's requirements into practical questions about ERP data and sets out what HR, finance, sales and IT each need to do.
Key Concepts in Business Terms
- Personal data: any information that identifies an individual, such as name, ID number, mobile number, email, address, bank account or photo.
- Sensitive data: a category needing stronger protection, including health, biometric and genetic data, racial or tribal origin, religious or political belief, and security or criminal data. In an ERP it usually appears in medical reports, sick leave and fingerprint or face-recognition attendance.
- Controller: the organization that decides why and how data is processed. Your company is the controller for its employees' and customers' data.
- Processor: a party processing data on your behalf, such as your cloud ERP vendor, an outsourced payroll provider or an SMS gateway.
- Processing: any operation on data, from collection and storage to viewing, transfer and deletion.
Mapping Personal Data Across ERP Modules
| Module | Typical data | Sensitivity | Who needs access |
|---|---|---|---|
| HR | ID, iqama, passport, marital status, qualifications | High | HR; line managers partially |
| Payroll | Salary, allowances, bank account, deductions | High | Payroll and finance only |
| Time and attendance | Fingerprint or face template, location | Sensitive | HR; managers for their team |
| Leave | Sick leave and medical certificates | Sensitive | HR, restricted |
| Sales and service | Individual customers' names, mobiles, addresses, purchase history | Medium | Sales and collections |
| Purchasing | Supplier contact names and numbers | Low to medium | Procurement |
| Property management | Tenant identities and contact details | High | Property team and collections |
This table is the seed of your record of processing activities, covered below. Many companies building it discover sensitive data copied into places it never needed to be: Excel exports on personal laptops, or attachments sitting in email.
Core Requirements and What They Mean for ERP Data
1. A lawful basis for each processing purpose
Consent is not the only basis. Processing an employee's data to pay salary and register them with GOSI rests on the employment contract and legal obligations. Using customer data for direct marketing is different: it requires consent, and the Implementing Regulations require an easy way to stop marketing messages at any time. For each data type in your system, record why you collect it, and stop collecting what you do not need.
2. Data subject rights
Individuals have the right to be informed about processing and its legal basis, to access their data and receive a free copy, to have it corrected or updated, to request its destruction when no longer needed, and to complain to the regulator. Controllers must respond within 30 days, extendable by another 30 days in defined cases such as requests needing unusual effort. In practice, you need a way to pull everything you hold on one person from every module, quickly.
3. Record of processing activities
Controllers must keep a record describing processing activities and the organizational, administrative and technical measures in place, for as long as the processing continues and for five years after it ends.
4. Impact assessments
A data protection impact assessment is required in cases including processing sensitive data, linking two or more datasets from different sources, continuous monitoring of individuals, new technologies and automated decision-making. Rolling out face-recognition attendance with location tracking is a clear example that calls for one before go-live.
5. Breach notification
Where a breach must be notified, SDAIA should be informed through the National Data Governance Portal within 72 hours of becoming aware of it, and affected individuals notified without undue delay where required.
6. Data protection officer
A DPO is mandatory where the controller is a public entity processing data at large scale, where its core activities involve regular, continuous, large-scale monitoring of individuals, or where its core activities involve processing sensitive data. Many mid-sized private companies fall outside these triggers, but naming one accountable person is still good practice.
7. Transfers outside the Kingdom
Transfers are permitted under conditions: they must not prejudice national security or vital interests, and should be limited to the minimum data needed. The Transfer Regulations allow reliance on adequacy decisions or safeguards such as standard contractual clauses, binding common rules and certifications, with a transfer risk assessment required in some cases. If your cloud ERP is hosted abroad, or the vendor's support team accesses data from outside Saudi Arabia, that is a transfer to assess.
Penalties
Disclosing or publishing sensitive data with intent to cause harm or for personal gain carries up to two years' imprisonment and/or a fine of up to SAR 3 million. Other violations can bring a warning or a fine of up to SAR 5 million, and fines can be doubled for repeat offenses. Affected individuals may also claim compensation for material or moral damage. The fine is not the only exposure: losing employees' and customers' trust after a payroll file leaks often hurts more.
Controls Inside the ERP
Role-based access
The first question is who sees what. A salesperson has no reason to see anyone's salary. A line manager may need their team's attendance but not their pay. Build an access matrix starting from least privilege, review it every six months, and disable leavers' accounts on their last day.
Export and print control
Most corporate data leaks are not sophisticated attacks. They are payroll files exported to Excel and emailed to the wrong person or left on a laptop. Restrict export rights for reports containing sensitive data and keep reporting inside the system wherever possible.
Masking
Showing only the last four digits of bank account or ID numbers on general screens reduces exposure without slowing anyone down.
Audit trail
A log of who opened an employee file or changed a bank account, and when, deters misuse and supports investigation after an incident.
Retention and destruction
This is where PDPL meets other laws that require you to keep records. VAT records generally must be kept for at least six years, records for movable and intangible capital assets for 11 years, and real estate for 15 years; the Commercial Books Law requires ten years. The right to destruction does not mean deleting a tax invoice issued to an individual customer. It means not keeping data longer than legal or operational need, with a written policy per data type.
| Record | Reason to keep | Action at end of period |
|---|---|---|
| Tax invoices | VAT law | Destroy or anonymize after the statutory period |
| Leaver's employee file | End-of-service settlement, potential disputes | Remove sensitive attachments, keep the minimum |
| ID and iqama copies | Hiring requirements | Delete the image once no longer needed |
| Marketing contacts | Consent | Delete on withdrawal of consent |
Infrastructure security
For cloud systems, the National Cybersecurity Authority has issued the Cloud Cybersecurity Controls (CCC-2:2024). The cloud computing regulatory framework classifies government data into levels and does not allow government data to leave the Kingdom. If you work with government entities and handle their data, that shapes where your system can be hosted. For more on the security side, see our article on ERP cybersecurity.
Biometrics and Location Tracking
Fingerprint and face-recognition attendance, and location-stamped check-ins for field staff, are now common in contracting, distribution and services. They curb buddy punching and time fraud, but they collect sensitive biometric data or continuous location data, so set them up carefully:
- Assess before go-live: biometric processing and continuous monitoring are both triggers for an impact assessment.
- Limit scope: capture location at check-in and check-out within the defined site, not all day or outside working hours.
- Tell employees plainly: what is collected, why, who sees it and how long it is kept.
- Restrict access: nobody needs to see fingerprint templates; reports only need attendance times.
- Set retention: delete a leaver's biometric templates and keep attendance logs only as long as needed for pay and disputes.
Worked Scenario: A Payroll File Sent to the Wrong Address
Hypothetically, on a Sunday morning a payroll accountant emails an Excel file with 140 employees' names, salaries and bank account numbers to an outside supplier instead of the bank, because the addresses autocomplete alike. Here is what the next 72 hours should look like:
| When | Action | Owner |
|---|---|---|
| First hour | Contact the recipient, ask them to delete the file and confirm in writing | CFO |
| Day one | Document the incident: what data, how many people, who received it, what was done | Data protection lead |
| Day two | Assess risk and decide on notification, with legal advice if needed | Senior management and counsel |
| Before 72 hours | Notify SDAIA if the incident requires it; inform affected employees where needed | Data protection lead |
| Afterwards | Fix the root cause: stop emailing payroll files and pay from the system directly | IT and payroll |
The root cause was not technical. It was a process built on exporting a file and sending it by hand. The durable fix is to remove the need for the export.
Responding to an Access Request
A former employee who left six months ago asks what data you hold about them. Within 30 days you need to verify their identity, pull their data from HR, payroll, attendance and leave as well as any attachments, mailboxes and shared folders, explain the basis for each category (for example, payroll records kept for end-of-service calculations and statutory retention), provide a clear free copy, and log the request and response date. If their data is scattered across a separate payroll tool, attendance spreadsheets and shared drives, this takes days. In one integrated system, it is faster and less likely to miss a source.
What Each Department Owns
- HR: collect ID copies and medical certificates only from candidates who receive offers, restrict who sees sick leave, and define what is removed from a file after final settlement.
- Finance and payroll: bank account changes are a favorite fraud route. Require a second approval and a phone verification for every change, and log who made it.
- Sales and marketing: separate data needed to sell and collect from data used for marketing, which needs consent. Do not add invoice contacts to SMS campaigns without it.
- IT: accounts, permissions, backups and audit logs, plus vendor access. Backups contain the same personal data and need the same protection and retention rules.
Common Mistakes
- Treating compliance as a legal project only: a polished privacy notice is meaningless if payroll is emailed every month.
- Inherited permissions: someone moved from payroll to sales and still sees salaries.
- Shared logins: one username for several people makes the audit trail worthless.
- Live data in test environments: production copies used for testing without masking.
- Ignoring processors: no data protection terms in contracts with vendors who process your data.
A Six-Step Compliance Plan
- Map the data by module and in every file outside the system.
- Record purpose, basis and retention for each data type.
- Review access on least-privilege principles and close unused accounts.
- Review processors: contracts covering obligations, hosting location and breach handling.
- Write request and incident procedures before you need them, including who decides on 72-hour notification.
- Train HR, payroll and sales staff, your first line of defense.
Questions to Ask Any ERP Vendor
- Where is the data hosted, and who at the vendor can access it, from where?
- Can permissions be set by screen, field and report?
- Is there an audit trail for viewing and changing sensitive data?
- Can all data on one person be extracted easily?
- What is the vendor's incident process, and how fast will they tell you?
For hosting trade-offs, see our comparison of cloud and on-premise ERP.
Where Tranquil Fits
Tranquil is a cloud ERP that brings HR and payroll, accounting and sales into one platform, reducing the scattered files that carry employee and customer data. The employee self-service portal lets staff view their own data and requests, which supports access rights and cuts document traffic by email, and bank integration pays salaries directly, reducing manual payroll file handling. Screens, reports and multi-level approvals can be customized to your policies. Put the vendor questions above to our team before you sign, as you would with any provider.
Frequently Asked Questions
Does PDPL apply to employee data?
Yes. IDs, salaries, bank accounts and sick leave are personal data, some of it sensitive, and fall under the law just as customer data does.
Do we need employee consent to run payroll?
Usually not, since processing rests on the employment contract and legal obligations. Additional uses outside the employment relationship may need another basis.
How long do we have to answer a data subject request?
Thirty days, extendable by another thirty in defined cases.
When must a breach be reported?
Within 72 hours of becoming aware, to SDAIA, where the breach requires notification, with affected individuals informed without undue delay where needed.
Does the right to destruction mean deleting old invoices?
No. Invoices and accounting records have statutory retention periods; destruction comes after legal and operational need ends. Contact the Tranquil team to discuss a setup that fits your policies.