Model Privacy Policy: Mandatory PDPL Elements

PDPL requires controllers to provide specific information to data subjects at or before collection. The privacy policy is the primary channel for this disclosure.

Identity and contact: controller name, address, and contact details. Where a DPO is appointed, their details are stated. SDAIA as supervisory authority may be included as a complaint reference.

Processing purposes: clear description of each purpose — marketing, contract performance, legal obligation, legitimate interest. Vagueness or generic disclosure is insufficient.

Legal basis: consent, contract performance, legal obligation, vital interests, or legitimate interest. Specifying the basis for each purpose clarifies data subject rights.

A transparent privacy policy obligates the organization to disclose purposes and legal basis — ambiguity exposes to accountability.

Data subject rights: right to access, rectify, erase, restrict, object, and data portability. The mechanism for exercising rights — form or email — must be clear. Response timeframe (typically 30 days) is recommended to specify.

Retention period: the duration data is retained or criteria for determining it. PDPL requires that processing not exceed what is necessary for the purpose.

Cross-border transfer: if transfer outside the Kingdom occurs, it must be disclosed with reference to safeguards — adequacy, standard clauses, or consent.

Sensitive data and children: processing sensitive data requires a stronger basis — often explicit consent. Children's data receives additional protection — parental consent is required where applicable.

Cookie policy: if tracking technologies are used, a separate policy or dedicated section is recommended. Consent for non-essential cookies is withdrawable.

Updates: the privacy policy is updated when practices change. Notice of material changes — by email or notice — is recommended.

References: Personal Data Protection Law PDPL — SDAIA. Interpretive regulations.