Navigate the data protection obligations that apply to your business today.
India's DPDP Act and Saudi Arabia's PDPL are both in force. Organisations operating across both markets face concurrent obligations. We help you understand exactly what applies - and build the compliance programme to meet it.
Regulatory Scope
Data Principal Rights
Consent Management
Breach Notification Mandate
72-hour window - DPDP / PDPL / GDPR
Two regulations. One integrated compliance programme.
Running separate compliance workstreams for DPDP and PDPL duplicates effort. We map the overlap, identify the conflicts, and build a single programme that satisfies both.
Digital Personal Data Protection Act, 2023. Rules notified and in force.
Key Obligations
Applies to any entity processing digital personal data within India, or processing data of Indian residents outside India.
Personal Data Protection Law. Enforced by NDMO.
Key Obligations
Applies to any entity processing personal data of individuals in Saudi Arabia, regardless of where the entity is based.
We also advise on related frameworks
GDPR Advisory
For organisations with European customers, users, or operations. We help you understand your GDPR obligations and build a proportionate compliance programme - particularly relevant for Indian SaaS firms serving European markets.
Multi-Jurisdiction Mapping
Organisations operating across India, GCC, and Europe often face three or more concurrent privacy obligations. We map your actual data flows against each applicable regulation and identify overlaps and conflicts - so you're not running three separate programmes.
Applicability Assessment
Not sure which regulations apply to your business? A structured applicability assessment - typically completed in one to two weeks - clarifies your exposure and gives you a prioritised compliance roadmap.
From obligation mapping to operational compliance
Four stages. Evidence trails at every step.
Applicability assessment
Establish which regulations apply to your data flows, markets, and business model. Some organisations are surprised by what applies.
Data mapping
Document what personal data you collect, where it lives, how it moves, and who has access. The foundation of every compliance programme.
Gap analysis
Measure current practice against regulatory requirements. Produce a prioritised gap register with remediation effort estimates.
Implementation
Build the policies, consent frameworks, privacy notices, and technical controls to close the gaps - with evidence trails for regulatory review.
If you process personal data of Indian or Saudi residents, these obligations apply.
Regardless of where your organisation is headquartered - if you have Indian or Saudi users, customers, or employees, DPDP and PDPL apply to you.
Know your obligations. Build the programme.
We start with an applicability assessment - so you know exactly what applies to your business before committing to a full compliance programme.