Compliance checklists you can actually use.

1. Lawful basis & notice

• Identify a lawful basis for every processing activity.
• Publish a PDPL-aligned privacy notice (purpose, data, retention, rights, contact).
• Where cookie processing relies on consent, obtain it before processing without preselected choices.

2. Consent & rights

• Consent is specific, informed, and withdrawable.
• Obtain marketing consent and provide a clear opt-out.
• A working process to handle data-subject requests (access, correction, deletion).

3. Records & governance

• Maintain a Record of Processing Activities (RoPA).
• Assess DPO appointment under the effective rules; do not treat a proposed amendment as binding.
• Ability to respond to SDAIA inquiries within the statutory window.

4. Security

• Technical + organizational safeguards proportionate to risk.
• Data classification applied before storage/hosting.
• Prepare SDAIA notification within 72 hours of awareness where a breach may harm personal data or subjects, or conflict with their rights or interests.

5. Cross-border transfers

• Verify any destination adequacy decision directly; this review did not locate a published list.
• Select the transfer route and safeguard with its conditions; SCCs, Binding Common Rules and accreditation are not interchangeable for every case.
• Complete risk assessment before Article 4 transfers and continuous or large-scale sensitive-data transfers.

6. Vendors

• Processor agreements with PDPL clauses.
• Sub-processor controls and locations documented.

Step 1: Are you CNI?

• For government or CNI entities, establish ECC/DCC scope and applicable supplementary controls.
• For a non-CNI private entity, verify NCA notification before determining the NCNICC duty.

Step 2: Which category?

• Category A for large entities: 65 controls across three domains.
• Category B for small and medium entities: 26 controls within one domain.
• Verify the Monshaat category and its boundaries against the notice; size alone does not establish scope.

Step 3, Category A: Governance

• Cybersecurity governance + defined roles.
• Periodic risk assessments.
• Policies reviewed and approved.

Step 3, Category A: Cybersecurity Defense

• Access management.
• Endpoint protection.
• Data classification.
• Backup management.
• Monitoring + logging.
• Incident response procedures.
• Periodic penetration testing.

Step 3, Category A: Third-party & Cloud

• Third-party/vendor cybersecurity requirements.
• Cloud computing cybersecurity controls.
• Employee awareness training.

Step 4: Category B

• Implement the 26 Category B controls specified in the official document and your notice.

Before any transfer abroad

• Identify the transfer purpose, processing basis and destination.
• Map data, recipients, foreign access and subsequent transfers.
• Verify adequacy or the specific exemption and safeguard conditions under Article 4.
• Complete risk assessment for Article 4 transfers and continuous or large-scale sensitive-data transfers.
• Document sector restrictions, national-security conditions, minimization and any exemption actually applicable.
• Approve arrangements before the first transfer and review when the flow changes.