The law in brief
Saudi Arabia's Personal Data Protection Law (PDPL) is overseen by the Saudi Data and AI Authority (SDAIA). It came into force in September 2023, with a one-year period for compliance. It sets how personal data is collected, used and stored, and gives people rights such as knowing what is collected about them, accessing it and correcting it.
Health data is treated as sensitive under the law, and much of a child's file falls into that category.
This article is a general introduction and does not replace legal advice for your center.
What it means at the center
- Collect only what you need. Every field on the intake form should have a reason.
- Decide who sees what. Therapists need their children's files, accounts staff need invoices, and nobody needs everything.
- Know where the data is stored and who can reach it outside the center.
- Be able to answer parents who ask what you hold about their child.
- Keep backups, and know how to restore them.
Questions to ask any system provider
- Where is the data hosted, inside the Kingdom or outside it?
- Are the system and the hosting provider PDPL compliant?
- How are permissions managed, and are they enforced on the server or only in the interface?
- When are backups taken?
- Does the data belong to the center, and can it be exported in full if the center changes systems?
How this works in Enable 360
Enable 360 is cloud hosted in data centers inside Saudi Arabia, and both the system and its hosting provider are PDPL compliant. It has 253 granular permissions across 81 modules, enforced in the interface and on the server. A backup is taken before every system update, and the data belongs to the center, which can export all of it at any time.
Security & rolloutFrequently asked questions
Is data at rehabilitation centers sensitive?
Much of it is, such as health data and diagnoses, and it needs extra care.
Where is Enable 360 data hosted?
In data centers inside Saudi Arabia.
Can a center get its data back if it leaves the system?
Yes. The data belongs to the center and can be exported in full at any time.
Last reviewed:
